model-context-builder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The document contains examples that embed API keys/tokens directly in command-line args and HTTP headers (e.g., -e API_KEY=abc123, -H "Authorization: Bearer token123", -e GITHUB_TOKEN=ghp_xxx), which would require an LLM to emit secret values verbatim in generated commands/requests, creating an exfiltration risk.