flight-profiler-vmtool

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The vmtool executes arbitrary Python expressions in a target process and returns attribute/method values verbatim (e.g., [i.secret for i in instances]), so it can easily expose API keys, passwords, or tokens present on objects — the prompt therefore enables direct exfiltration of secrets.