source-code-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to search for and report hardcoded credentials and to report each match with file path, line number, and surrounding context (and to notify state manager of confirmed credentials), which requires outputting secret values verbatim and thus creates an exfiltration risk.