telnyx-video-go

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a literal-looking refresh token hard-coded in an example (a secret value printed verbatim), which encourages the LLM to reproduce sensitive credentials rather than using secure env-var or CLI-based auth.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The document contains a full, high-entropy JWT literal assigned to RefreshToken in a code example (complete header.payload.signature, not truncated or a placeholder). This is a direct, usable credential pattern (high entropy and not an obvious example placeholder), so it should be flagged as a secret.

Items ignored: TELNYX_API_KEY is only an environment variable name (no value) and therefore not a secret; UUIDs and example/simple strings in the doc are resource IDs or placeholders and not flagged.