telnyx-video-python

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a hard-coded refresh_token/JWT value in an example (verbatim secret), which would require the LLM to handle/output a secret directly and creates an exfiltration risk.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a literal, high-entropy JWT-like token used as the refresh_token in examples (long base64 segments + signature). This is not a placeholder (e.g., YOUR_API_KEY) nor a simple setup password; it appears to be a real, usable credential and therefore should be flagged. Other values (UUIDs like "0ccc7b54-...", environment variable name TELNYX_API_KEY, and normal example strings) are low-entropy or clearly placeholders and are ignored.