The Agent Skills Directory

CREDENTIALS_UNSAFE (HIGH): The authentication documentation in auth.md explicitly recommends using SHA1 to hash passwords before transmission. SHA1 is a deprecated and cryptographically broken algorithm that is highly vulnerable to brute-force and collision attacks.
CREDENTIALS_UNSAFE (MEDIUM): The auth.md and getting-started.md files recommend storing sensitive authentication tokens in localStorage or sessionStorage. This pattern is risky because these storage mechanisms are accessible to any script on the page, making tokens susceptible to theft via Cross-Site Scripting (XSS) attacks.
EXTERNAL_DOWNLOADS (MEDIUM): An automated security scan (URLite) flagged the domain userApi.co as a malicious URL. While the string is not literally present in the provided documentation snippets, the library uses the variable name userAPI as a primary entry point for its core functionality, suggesting a potential configuration risk or an intended endpoint for the library's network operations.
EXTERNAL_DOWNLOADS (LOW): The library requires a wide range of peer dependencies, including axios, lodash, and crypto-js. This broad dependency tree increases the supply chain risk surface for any application integrating this client library.

airiot