Opus finding
Pattern 'curl\s+http://' only flags http (not https) network calls and labels them MEDIUM
lowapi-contracthigh
- skills/skill-security-scan/scan.sh:153-156
The MEDIUM list flags only plain http://, implying https calls are considered safe. But https exfiltration is the dominant real-world pattern, and the threat model in SKILL.md explicitly calls out 'Send environment variables, tokens, or file contents to external URLs via curl/wget/fetch'. The narrow match makes the scanner ineffective against the very threat it advertises.
Recommendation
Add a domain-allowlist check for any outbound curl/wget/fetch destination, regardless of scheme; or at minimum add MEDIUM patterns for `curl\s+https://` with allowlist exceptions.