bm-share

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to copy a note's full content (including frontmatter) verbatim into a shared project, which will cause any secrets or credentials present in the source note to be output and stored unless the agent detects and blocks them—this creates an exfiltration risk and is not enforced by the prompt.