add-to-existing-project

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples of passing API keys on the command line (e.g., npx tambo init --api-key=sk_...) and implies creating .env files from that input, which would require the agent to accept and embed secret values verbatim—an insecure pattern.