asa-roas-analysis

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill’s data-pull examples include explicit parameters like rc_key: "<sk_xxx>", rc_project: "<proj_xxx>", and app_id: "<apple_app_id>" in command blocks, which implies the agent must supply API keys/tokens verbatim when invoking those tools, creating a secret-exfiltration risk.