hindsight-cloud

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to ask the user for their API key and to write it verbatim into a generated config file (and to substitute the bank ID into commands), which requires the LLM to handle and output secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup instructs running "curl -fsSL https://hindsight.vectorize.io/get-cli | bash", which downloads and executes remote code during installation (a required CLI dependency for the skill), so the fetched content can execute arbitrary code at runtime.