code-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs a repo-hygiene reviewer to scan file contents for hardcoded keys and to include evidence-backed findings (file:line and code citations) but does not require redaction, meaning secrets present in the repo could be copied verbatim into REVIEW.md or chat output, creating an exfiltration risk.