maestro-player

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The coordinator asks users for missing variables and binds them into {skill_call} rows written to wave CSVs, while sub-agents are explicitly instructed to "原样执行技能调用" and must return the skill_call in their output, which forces any secrets provided to be embedded verbatim in LLM-handled input/output (high exfiltration risk).