watt

[Skill Scanner] Credential file access detected All findings: [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] [HIGH] supply_chain: Installation of third-party script detected (SC006) [AITech 9.1.4] [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] This skill is purpose-aligned and describes legitimate integration tasks for Platformatic Watt. I found no explicit malicious code or backdoors in the text. However, there are moderate supply-chain and data-exposure risks: npm installs are unpinned (npm install / npx commands execute third-party code), wattpm CLI commands can reveal environment variables, and telemetry or cloud deployment endpoints could be misconfigured to exfiltrate data. The skill should be treated as functionally benign but with moderate operational risk typical of installer/CLI workflows; follow best practices: pin package versions, audit packages before npm install/npx, avoid exposing secrets in env or CLI output, and verify telemetry endpoints. LLM verification: This is documentation for integrating Platformatic Watt. The content itself does not contain direct malicious code, but it relies on installing and running unpinned third-party npm packages (wattpm and @platformatic/*). That pattern creates a moderate supply-chain risk: installed packages will execute with local environment and filesystem access and could exfiltrate credentials or perform other malicious actions if compromised. The scanner flags referencing config paths and .docker are documenta