yy-frontend-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to read files and include offending code lines/snippets in its audit output (e.g., "代码: ..."), so if those files contain hardcoded API keys/passwords the LLM will see and likely output them verbatim, creating an exfiltration risk.