adspower-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly allows/encourages passing an API_KEY via a --api-key command-line flag (or including it in commands), which would require the LLM to embed secret values verbatim in generated output and poses an exfiltration risk, even though environment-variable usage is also mentioned.