security-audit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly directs scanning for hardcoded API keys and even lists real key prefixes (e.g., sk-, AIza, ghp_), so while it doesn't demand asking users for secrets, it inherently requires reading—and may report—secret values verbatim from the codebase, creating exfiltration risk.