gitlab

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs using the GITLAB_TOKEN in curl requests and even shows embedding it into a git remote URL (https://oauth2:${GITLAB_TOKEN}@...), which requires the agent to insert the secret value verbatim into commands/requests, creating a high exfiltration risk.