telnyx-video-javascript

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a literal refresh_token JWT embedded in an example API call (and demonstrates passing API keys directly), which requires the agent to handle and could output a secret value verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The sample includes a full, high-entropy JWT literal used as the refresh_token in the example code (starts with "eyJhbGci..."). It is not a placeholder, truncated value, or a simple setup password — it contains issuer/audience fields and an exp/iat timestamp, so it appears to be a real token-like credential. Even if the token's exp suggests it may now be expired, it is a literal secret in the docs and should be flagged.