slack-post

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes insecure patterns — explicit examples of passing tokens as command-line flags and an Authorization header (e.g., --token "" and -H "Authorization: Bearer ${GITHUB_TOKEN}") that encourage embedding secrets verbatim, even though it also mentions env vars and warns against printing tokens.