device-interaction

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly asks the agent to "verify the login feature" (implying use of credentials) and exposes a "sender keyboard kbd " command where all content after kbd is taken verbatim — forcing the LLM to emit exact text (e.g., usernames/passwords) into an interactionCommand and thus risking secret exfiltration.