doc-vault-save

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs building shell commands that pass the note frontmatter/body verbatim via CLI arguments (e.g., notesmd-cli create --content "{frontmatter + body}"), so if the conversation content contains secrets (API keys, tokens, passwords) the LLM must include them verbatim in generated commands/outputs, creating an exfiltration risk.