fix: address snyk findings and harden skills

[jeremy-london]

Summary

This PR fixes some findings during initial release found through a Snyk scan. There is no vulnerability just general best practice. When a scanner sees password or the use of a password argument its best to find an alternative path or request an interactive input from the user to prevent any leaks or hallucinations.

keeper-admin SKILL had some language that cause this finding:

HIGH W007: Insecure credential handling detected in skill instructions.

Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples that pass passwords, tokens, and secret field values directly in commands (e.g., --password "master_pw", --field password=s3cur3, --token "XX:XXXXXXXXXX"), which would require the agent to handle or emit secret values verbatim if it generated similar commands or scripts.

keeper-setup SKILL had some language that caused these findings:

HIGH W007: Insecure credential handling detected in skill instructions.

Insecure credential handling detected (high risk: 1.00). The skill shows and instructs using a One-Time Access Token passed directly on the command line (ksm profile init --token "US:XXXXXXXXXX"), which encourages embedding a secret verbatim in commands/outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

Potentially malicious external URL detected (high risk: 0.80). The skill instructs runtime fetching and installation of remote code (git clone https://github.com/Keeper-Security/Commander followed by pip install -r requirements.txt && pip install -e . and links to binary installers at https://github.com/Keeper-Security/secrets-manager/releases), which will download and execute external code on the host, so these URLs are runtime dependencies that can execute code.

Related issue

Type of change

• Documentation (skills, references, README, etc.)
• Plugin / marketplace metadata (.claude-plugin/or .cursor-plugin/)
• CI / tooling (workflows, hooks, Taskfile)
• Other (describe below)