env-scanner

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to read and record "Default — value from .env.example or code fallback" and write those values into CONFIG-MAP.md, which forces the LLM to output any secret/API key/password present in repo files verbatim, creating an exfiltration risk.