credentials

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks for a credentials file or manual entry, parses and extracts raw API keys, and instructs writing/validating them (including generating .env and curl requests), which requires the LLM to handle and potentially output secret values verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill content for literal, high-entropy credential values. Most examples are placeholders (e.g., "sk-proj-xxxxx", "sk-ant-xxxxx", "rnd_xxxxx", "sk-ant-xxx...", "xxx...") or pattern descriptions and are ignored as documentation placeholders.

However, Format 3 contains an explicit client id and secret:

• client id: Y1FgKALKmb6f6UxFtyMXfA
• secret: -QLoYdxMqOJkYrgk5KeGPa6Ps6vIiQ

These are random-looking, high-entropy strings that appear to be real Reddit client credentials (not a generic placeholder). The later service-specific section also references the same values (shortened with ellipses), confirming those values are present in the document.

No other actual API keys or private-key blocks are present; remaining occurrences are placeholders/patterns and thus ignored.