claude-code

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires relaying the user's request "verbatim" into a CLI prompt (the --prompt argument) and to "preserve that detail verbatim", so if a user supplies API keys/passwords those secrets must be embedded and passed through the LLM output/command unredacted, creating an exfiltration risk.