seo-report-pdf

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to prompt the user to paste their login and API password into chat, then parse and write those secret values verbatim into a .env file and use them in a verification call, which requires the LLM to handle secrets directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly instructs the assistant to prompt users to paste API credentials into the chat, parse and save them to a local .env, and use them to make verification API calls—an explicit credential-collection flow that can be abused for data exfiltration.