social-publisher

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt shows and encourages embedding the workspace API key in commands (exporting and using SC_API_KEY, a curl Authorization header, and a socialclaw login --api-key <workspace-key> flag), which requires the agent or user to place the secret verbatim into commands/outputs — an exfiltration risk.