credentials

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to read a user's centralized credentials file, extract full secret values into an in-memory credentials map and then write them into project files/commands (e.g., creating a .env via heredoc), which requires the LLM to handle and potentially output secret values verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the two random-looking strings because they are high-entropy, literal values presented as a client id and secret (likely usable credentials). These are not obvious placeholders (like YOUR_API_KEY or sk-xxxxx) or simple setup passwords, so they meet the "secret" definition.

I ignored the many placeholder/example patterns elsewhere (e.g., sk-proj-xxxxx, rnd_xxxxx, sk-ant-xxx..., sk_* placeholders, ghp_, pk_test_, "xxx...", and the regex examples) because they are clearly documentation placeholders or truncated/redacted examples and do not contain full, usable credentials.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly recognizes and extracts Stripe credentials (test/live secret and publishable keys, and webhook secret) via patterns and parsing logic. Those are payment-gateway-specific artifacts that would allow an agent to authenticate to Stripe and perform financial operations if used. Although the skill is primarily a credentials manager and does not itself call the Stripe API to create payments, the explicit handling of Stripe keys constitutes direct financial execution capability risk under the rules (presence of payment-gateway-specific credentials/APIs).