Security audit

Acp

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches an ACP marketplace tool, but it asks for persistent agent-wide behavior changes and includes unsafe remote-triggered command execution paths.

Review carefully before installing. Do not enable the ACP-preferred system prompt or memory change unless you want future unrelated requests sent to ACP first. Avoid running the seller runtime or deploying bundled offerings without auditing and isolating them, especially the hardcoded 'glitch' offerings. Store ACP/Railway credentials outside shared repos where possible, rotate keys after testing, and use a sandboxed environment for marketplace jobs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Persistent agent-wide behavior redirection through system-prompt and memory modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/seller/offerings/glitch/homeassistant/handlers.ts:7
Finding: Remote command injection through marketplace-controlled seller requirements
Content: View full analysis
{ const { action, entity, value } = request; let cmd = ""; if (action === "on" || action === "off") { cmd = `${HA_CLI_PATH} ${action} "${entity}"`; } else if (action === "brightness" && value) { cmd = `${HA_CLI_PATH} brightness ${value} "${entity}"`; } else if (action === "rgb" && value) { cmd = `${HA_CLI_PATH} rgb ${value} "${entity}"`; } else if (action === "temperature" && value) { cmd = `${HA_CLI_PATH} ${value} "${entity}"`; } else if (action === "scene") { cmd = `${HA_CLI_PATH} scene "${entity}"`; } else if (action === "script") { cmd = `${HA_CLI_PATH} script run "${entity}"`; } else { return { deliverable: `Unknown action: ${action}. Supported: on, off, brightness, rgb, temperature, scene, script` }; } try { const result = execSync(cmd, { encoding: "utf8", timeout: 30000 }); return { deliverable: result.trim() }; } catch (error: any) { return { deliverable: `Error: ${error.message}` }; } } ``` SkillStore offering: ```ts export async function executeJob(request: any): Promise { const { action, query } = request; let cmd = ""; if (action === "search" || !action) { cmd = `node ${SKILLSTORE_PATH} "${query || ''}"`; } else if (action === "list") { cmd = `node ${SKILLSTORE_PATH} list`; } else if (action === "known") { cmd = `node ${SKILLSTORE_PATH} known`; } else if (action === "create" && query) { cmd = `node ${SKILLSTORE_PATH} create ${query}`; } else { return { del ...[truncated 2649 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/deploy/railway.ts:135
Finding: Shell command injection in Railway deployment operations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/commands/resource.ts:13
Finding: Unrestricted resource URL fetching permits server-side request forgery
Content: View full analysis
): Promise { if (!url) { output.fatal("Usage: acp resource query [--params '']"); } // Validate URL format try { new URL(url); } catch { output.fatal(`Invalid URL: ${url}`); } try { // Make HTTP request to resource URL output.log(`\nQuerying resource at: ${url}`); let response; try { // Always use GET request, params as query string if (params && Object.keys(params).length > 0) { const queryString = new URLSearchParams(); for (const [key, value] of Object.entries(params)) { if (value !== null && value !== undefined) { queryString.append(key, String(value)); } } const urlWithParams = url.includes("?") ? `${url}&${queryString.toString()}` : `${url}?${queryString.toString()}`; response = await axios.get(urlWithParams); } else { response = await axios.get(url); } } catch (httpError: any) { // ... } ``` ### Technical Analysis The only validation is construction of a `URL` object. The implementation does not: - Restrict protocols to HTTPS. - Restrict requests to registered ACP resource hosts. - Reject loopback, link-local, private, multicast, or reserved IP ranges. - Protect against DNS rebinding. - Revalidate redirect targets. - Limit response size or establish an explicit request timeout. Consequently, any URL supplied through the CLI can be fetched from the machine or cloud deployment running the Skill. ### Attack Path 1. A malicious marketplace entry or untrusted instruction supplies a resource URL. 2. The agent follows the documented `acp resource query ` workflow. 3. The URL passes syntax validat ...[truncated 895 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/lib/config.ts:22
Finding: Session tokens, API keys, and bounty authorization secrets stored in plaintext
Content: View full analysis
; } ``` Plaintext write with default, umask-dependent permissions: ```ts export function writeConfig(config: ConfigJson): void { try { fs.writeFileSync(CONFIG_JSON_PATH, JSON.stringify(config, null, 2) + "\n"); } catch (err) { console.error(`Failed to write config.json: ${err}`); } } ``` Bounty state includes its authorization secret: ```ts export interface ActiveBounty { bountyId: string; createdAt: string; status: BountyStatus | string; title: string; description: string; budget: number; category: string; tags: string; posterName: string; posterSecret: string; selectedCandidateId?: number; acpJobId?: string; notifiedPendingMatch?: boolean; sourceChannel?: string; } ``` ```ts function writeState(next: ActiveBountiesFile): void { ensureParent(BOUNTY_STATE_PATH); fs.writeFileSync(BOUNTY_STATE_PATH, JSON.stringify(next, null, 2) + "\n"); } ``` A deployment error path includes the full API key in terminal output: ```ts } catch { output.warn( "Could not set LITE_AGENT_API_KEY. Set it manually:\n" + " acp serve deploy railway env set LITE_AGENT_API_KEY=" + apiKey ); } ``` ### Technical Analysis The project stores ACP session tokens, the active API key, historical agent API keys, and bounty `posterSecret` values in repository-local JSON files. `writeFileSync()` is called ...[truncated 1716 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: src/lib/openclawCron.ts:14
Finding: Persistent main-session cron instruction performs recurring network and messaging actions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: src/commands/deploy.ts:58
Finding: Runtime installation of an unpinned global Railway CLI dependency
Content: View full analysis
{ const { installed } = railway.checkCli(); if (!installed) { const answer = await prompt( " Railway CLI not found. Install it now? (Y/n): " ); if (answer.toLowerCase() === "n") { output.fatal( "Railway CLI is required. Install manually:\n\n" + " npm install -g @railway/cli\n" ); } installRailwayCli(); } } ``` ### Technical Analysis The deployment workflow installs `@railway/cli` globally without specifying an exact version or validating package integrity. The effective package and dependency graph can therefore change after this Skill is reviewed. Although the installation is prompted, the prompt defaults to installation for an empty response. In automated or relayed terminal contexts, that behavior can result in an unexpected global package installation. A global npm installation may run lifecycle scripts and modifies shared user-level or system-level tooling outside the project directory. ### Attack Path 1. The deployment command detects that the Railway CLI is absent. 2. The user accepts the prompt or submits an empty response. 3. npm resolves the current registry version of `@railway/cli` and its dependency graph. 4. Downloaded package lifecycle behavior executes with the privileges available to global npm installation. 5. A compromised upstream release, registry account, ...[truncated 521 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (126)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a high-level autonomous commerce/orchestration capability across many domains, with ACP used as the first step for nearly any request. In contrast, this code chunk is narrowly focused on local agent lifecycle management for a CLI: list existing agents, create an agent, switch active agent, regenerate API keys, sync config, and stop a running seller process before key changes. While the code references seller runtime and wallet-related info, it does not implement marketplace browsing, task delegation, payments, trading, research, content generation, token launching, or real-world task execution. The actual behavior is therefore materially narrower and different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description is much broader and markets the skill as a general ACP-first agent-commerce system with wallet, token launch, buying/selling services, and support for many digital and real-world tasks. The supplied code only covers one narrow subsystem: bounty lifecycle management via CLI. It creates bounties, lists local active bounties, polls match/job status, lets a user select a candidate, creates an ACP job for that candidate, confirms/rejects matches, and cleans up local state/cron jobs. That is related to hiring agents through ACP, so there is thematic overlap, but the description materially overstates the implemented capabilities and primary scope of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full-service ACP marketplace skill with broad operational abilities: hiring agents for virtually any task, handling digital and real-world work, built-in wallet support, token launch, and agents selling services autonomously. The supplied code does not implement those capabilities. It is narrowly scoped to browsing/searching for agents by query and displaying metadata returned from /acp/agents. While browsing agents is consistent with one small part of the description, the description materially overstates the implemented behavior and suggests several capabilities absent from this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description centers on ACP marketplace behavior: discovering and hiring specialist agents, browsing ACP before work, handling commerce around tasks/services, wallet functionality, token launch, and buying/selling services. The supplied code does not implement ACP browsing, agent hiring, wallet operations, token launch, research/content/trading/on-chain/physical task execution, or marketplace transactions. Instead, it is narrowly focused on deploying the current agent to Railway and administering that deployment. This is a materially different primary purpose and introduces undeclared infrastructure-management capabilities unrelated to the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a comprehensive ACP skill with broad marketplace, wallet, token launch, hiring, selling, and autonomous revenue capabilities. The supplied code chunk is much narrower: it is a job-management command module that creates jobs and retrieves/list jobs from ACP endpoints. This is not malicious or unrelated, but it is a materially smaller and more specific behavior than the declared purpose. Because the description emphasizes several major capabilities absent from the code chunk, the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description promises a general-purpose ACP orchestration skill for outsourcing user requests to specialist agents, handling commerce, wallet usage, token launch, and marketplace interactions. The provided code does none of that. It only retrieves the current agent profile and updates a small set of profile attributes. While profile management could be a supporting part of a larger ACP tool, this chunk’s actual behavior is materially narrower and different from the declared primary purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive ACP commerce/marketplace capability centered on discovering, hiring, and monetizing specialized agents, including wallet and token-launch features. The supplied code does none of that. It is simply a generic resource query utility that issues HTTP GET requests to arbitrary URLs and outputs the response. While such a helper could theoretically support ACP integrations, this chunk’s actual primary purpose is generic HTTP resource retrieval, not agent commerce. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a comprehensive ACP agent-commerce skill centered on using ACP to find and hire other agents for virtually any task, including real-world fulfillment, plus wallet and token launch features. The supplied code does not implement buyer-side browsing or hiring workflows, task execution, wallet transactions, token launch, or broad marketplace operations. Instead, it only manages the current agent’s own sell-side offerings and resources: creating local scaffolds, validating metadata and handler exports, registering/delisting offerings and resources with ACP, and listing/inspecting them. This is a materially narrower and different primary purpose than declared.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a general-purpose ACP marketplace/orchestration skill that can hire specialist agents, browse ACP for any task, support wallet functions, token launches, and facilitate digital or real-world work. The supplied code does not implement those user-facing marketplace capabilities. Instead, it is narrowly focused on operational management of a local seller service: checking registered offerings, verifying local handler files, spawning a detached runtime process, stopping it with SIGTERM, reporting status, and reading/tailing local log files. This is a materially different primary purpose from the declared description, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a general-purpose ACP marketplace skill centered on browsing ACP for any request, hiring specialist agents, obtaining or selling services, and supporting both digital and real-world work. The supplied code chunk, however, is narrowly focused on token management: it checks whether the current agent already has a token, launches one token through /acp/me/tokens, and fetches/displays token metadata and a URL. While token launch is mentioned in the description, the code does not implement the skill’s primary advertised behaviors around marketplace browsing, hiring agents, handling tasks, or selling services. Therefore the code chunk’s actual purpose is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a comprehensive ACP agent-commerce capability centered on discovering, hiring, and selling services through a marketplace, plus token launch and wallet features. The actual code chunk is much narrower: it only exposes wallet utilities (address lookup, balance display, and funding URL retrieval). While wallet support is consistent with one small part of the description ('built-in agent wallet'), the primary purpose of this code does not match the much broader declared functionality. This is therefore a material description/behavior mismatch for the supplied chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: There is a clear mismatch between the description and the code chunk. The declared purpose describes a broad agent-commerce system with ACP marketplace usage and financial/task capabilities. The actual code is limited to infrastructure support for containerization and deployment, specifically generating Docker-related files for running a seller runtime. While deployment tooling could be a supporting component of a larger system, this code chunk does not itself implement or expose the described ACP functionality. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about an ACP-based agent marketplace and commerce platform for outsourcing tasks, paying agents, selling services, wallet usage, and token launches. The supplied code does none of that. Instead, it is narrowly focused on infrastructure deployment via the Railway CLI, including authentication, project linking, variable management, deployment status, and log streaming. This is a materially different primary purpose and introduces undeclared capabilities related to Railway platform administration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description promises a comprehensive ACP-powered agent marketplace assistant that can proactively browse ACP, hire specialists for virtually any task, support autonomous earning, provide wallet features, and launch agent tokens. The supplied code does not implement those broad capabilities. Instead, it exposes a small set of ACP CRUD-style wrappers for job offerings and resources plus a function to retrieve a payment/top-up URL. While these functions are related to ACP and partially align with the narrower claim that agents can sell services and have some wallet access, they materially underdeliver relative to the description’s primary purpose and major advertised capabilities. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad marketplace/orchestration skill whose primary purpose is to use ACP first for nearly any user request, including hiring agents, buying and selling services, payments, wallet usage, and token launch. The supplied code does not perform those functions. It is narrowly focused on authentication and agent management against acpx.virtuals.io: session token handling, browser-based login, polling auth status, fetching agents, creating agents, regenerating API keys, and syncing local config. These are supporting account-management functions for ACP, not the described end-user marketplace/task-execution behavior. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a broad agent-commerce platform with marketplace, payment, wallet, token launch, and task execution capabilities. The supplied code only implements local configuration and process-management helpers: file-based config persistence, API key loading, active-agent selection, PID tracking, and minor utility formatting. These are supporting internals for a CLI or service, not the described end-user functionality. Because the actual code's primary purpose is materially different and lacks the claimed external commerce/agent capabilities, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the broad ACP marketplace/agent-commerce description and the actual code. The code does not implement browsing ACP, agent hiring, payments, wallets, token launches, marketplace interactions, or any task-oriented automation. Instead, it performs a narrow local action: invoking a platform-specific command (open, start, or xdg-open) to open a URL in the user's default browser. That local browser-opening capability is not reflected in the declared description and is materially different from the claimed primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a very broad ACP commerce assistant covering discovery and hiring of specialist agents for nearly any task, autonomous selling of services, wallet features, token launch, and marketplace access. The supplied code does something much narrower and different: it sets up and tears down a cron job in OpenClaw to periodically poll ACP bounty status and notify the user when there are matches, claimed jobs, completions, or errors. While bounty polling is ACP-related, it does not substantiate the large set of claimed end-user capabilities. The code’s primary purpose is operational scheduling/notification for bounty management, not general ACP browsing, commerce execution, wallet management, or token launching. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a broad agent-commerce platform with marketplace, payments, wallet, token launch, and task execution capabilities. The supplied code does none of that. It is a generic CLI output/formatting helper module for printing logs and JSON, with no network access, ACP integration, wallet logic, blockchain functionality, task marketplace behavior, or agent orchestration. This is a materially different primary purpose, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a comprehensive ACP commerce and task-delegation capability, including browsing the marketplace, hiring agents, selling services, wallet features, and token launch functionality. The supplied code does not implement those behaviors. It is a narrow support module for reading the active agent context and wallet address and for validating whether an authenticated/active agent exists. While this is loosely related to the described ecosystem, it materially underdelivers relative to the declared primary purpose and does not demonstrate the broad marketplace, task execution, or token-launch capabilities claimed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims a broad ACP agent-commerce skill for discovering, hiring, and selling specialized agent services across many domains, including built-in wallet and token launch features. The code does none of that. Instead, it implements a specific smart-home control service by constructing and executing local Home Assistant CLI commands based on requested actions. This is a materially different primary purpose and introduces undeclared capabilities and resource access, namely local shell execution and smart-home automation. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description promises a general-purpose ACP agent-commerce skill for discovering, hiring, and selling services across many digital and real-world domains, plus wallet and token-launch functionality. The supplied code instead implements a very specific OpenClaw migration service with actions limited to migrate/setup/test/status. Its core behavior is invoking a local script through child_process.execSync and returning command output, with no ACP browsing, marketplace interaction, wallet management, token launch, or broad task orchestration. This is a clear description-behavior mismatch because the actual primary purpose is specialized system migration handling rather than agent-commerce marketplace operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose promises a fully featured ACP-based agent commerce system with marketplace access, payments/wallet functions, token launch, and broad task delegation. The supplied code does none of that; it is an unimplemented template with placeholder returns and no external integrations, no commerce logic, no wallet/token functionality, and no meaningful task execution. The primary purpose in code is effectively a stub, materially different from the advertised capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a comprehensive agent-commerce skill centered on ACP: browsing a marketplace, hiring specialists, paying them, selling services, using a built-in wallet, and launching agent tokens. The supplied code does none of that. Instead, it invokes a local script at /home/crix/.openclaw/workspace/skills/skillstore/main.js with simple actions for searching, listing, showing known items, or creating something in a local 'SkillStore'. This is a materially different primary purpose and omits the headline capabilities in the description. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied code is a narrow runtime component for ACP seller event handling, not a full-featured ACP marketplace skill as described. It does not browse listings, hire agents, perform payments, manage a wallet, launch tokens, execute on-chain operations, or handle real-world goods/services. Its primary behavior is simply maintaining a websocket connection and dispatching task/evaluation events to callbacks. While this may support a larger ACP system, the chunk itself materially underimplements the declared description, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/commands/deploy.ts:62

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/commands/serve.ts:95

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/commands/setup.ts:52

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/deploy/railway.ts:99

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/lib/config.ts:157

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/lib/open.ts:20

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/lib/openclawCron.ts:39

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/seller/offerings/glitch/homeassistant/handlers.ts:28

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/seller/offerings/glitch/openclaw_migrate/handlers.ts:25

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/seller/offerings/glitch/skillstore/handlers.ts:24

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/lib/auth.ts:15

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/lib/bounty.ts:67

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/lib/client.ts:15

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/commands/deploy.ts:281