api-documentation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes hardcoded, secret-looking API keys and explicit examples that embed them verbatim in curl/snippets and docs (e.g., "Authorization: Bearer sk_live_abc123def456", stripe.api_key = "sk_live_abc123"), which would require the LLM to output secret values directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill prompt explicitly documents a Payment Processing API with concrete, actionable endpoints and examples to create charges, capture payments, and refund transactions (e.g., POST /charges, POST /charges/{id}/refund). It includes authentication patterns showing live API keys (sk_live_*), Postman collection and runnable SDK/curl examples that perform real payment operations, and references to Stripe-like client calls. These are specific financial-execution capabilities (creating charges, refunds) rather than generic API documentation, so it grants direct financial execution authority.