telnyx-video-ruby

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a hard-coded refresh_token JWT literal in an example (and shows token strings in responses), which requires or encourages the agent to include secret values verbatim and thus poses high exfiltration risk.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a full, high-entropy JWT (starts with "eyJhbGciOiJIUzUxMiIs...") included inline as the refresh_token in the refresh_client_token example. It is not a placeholder, truncated, or an obvious low-security example — it appears to be a real, usable token (header.payload.signature). Therefore it meets the definition of a secret and should be flagged. (Environment variable names like ENV["TELNYX_API_KEY"] are placeholders and ignored.)