security-hooks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The hooks echo tool_input.command and file paths into JSON/stderr (e.g., permissionDecisionReason: "... $COMMAND"), so if a command or path contains credentials (Bearer tokens, cookies, etc.) the LLM would receive and output those secrets verbatim, creating an exfiltration risk.