security-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt instructs running grep/scan commands that will print matching lines (including token shapes and high-entropy secrets like AKIA/ghp_/sk-), and then asks the agent to assemble a report of findings, which implicitly requires capturing and likely outputting those secret values verbatim — creating strong exfiltration risk.