remix-api-reference

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires the agent to include an Authorization: Bearer <api_key> header when generating or executing API calls but gives no secure handling (env vars/CLI auth), so the LLM would need to accept and embed secret API keys verbatim in requests/outputs, creating exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching the OpenAPI spec at runtime from https://api.remix.gg/docs/json, and that remote JSON directly controls which endpoints, methods, and request/response schemas the agent will generate and execute, so it is a runtime dependency that governs agent behavior.