access-control

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires including "exact file location with code snippet" and scans config/JWT/session files, so if those files contain hardcoded API keys, tokens, or passwords the agent would reproduce them verbatim in its findings, creating an exfiltration risk.