evaluate-rag

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly instructs the LLM to extract a "fact" from a text chunk and return it verbatim in JSON (and to map queries to exact chunks), which would force the model to output any secret values present in those chunks, creating an exfiltration risk.