codegrid

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds an explicit token-like string ("0x6B456E66...") which is an actual secret/API token value present verbatim in the skill and therefore risks exfiltration if the LLM is ever asked to reproduce or use it in output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found one literal, high-entropy value: the "Token (Base): 0x6B456E66524aEC1792013eF9DFE87e3F84311ba3" line in SKILL.md. It is not a placeholder nor truncated/redacted and appears to be an unredacted token-like value (hex string) that could grant access, so it meets the definition of a secret to flag.

Other potential candidates were ignored:

• Example session id "acc7bc6d-…" is truncated with "…" (redacted/truncated) — ignored.
• Various file paths, socket names, method names, and sample commands are not secrets.
• No PEM/private-key blocks or obvious "sk-live-..." style API keys were present.