web-discovery

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to capture and record discovered credentials/tokens (e.g., write add_credential(username=..., secret=..., source=...)) and save evidence files that may contain secrets, and shows examples of embedding tokens in commands/headers, requiring the LLM to output secret values verbatim.