signal-detector

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates capturing the user's "exact phrasing" for every inbound message and writing/updating brain pages via put_page, which means any secrets or API keys present in user messages would be included verbatim in the agent's generated tool calls and storage — creating an exfiltration risk.