code-review-checklist

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a literal-looking API secret ('sk_live_abc123xyz') in a "Bad
• Hardcoded secret" example, which forces the model to handle/output a secret value verbatim and is therefore high-risk credential exposure.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill contains explicit payment gateway code: a hardcoded Stripe secret key example (sk_live_...) and a snippet calling stripe.charge(total). These are specific references to a payment API (Stripe), which constitute direct financial execution capabilities.