provider-key-manager

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires embedding API keys verbatim (e.g., openclaw.json env.vars with actual key values and the CLI form manager.py update <provider> <new-key>), so an agent following it would need to output or include secret values directly in commands/configs.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)