ops-settings

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for new credential values and store them in JSON via jq using environment variables, but the liveness and smoke test sections include curl commands that pass API keys directly as command-line arguments (e.g., -u "${stripe_key}:" or -H "Authorization: Bearer ${new_key}"), which exposes the secrets through the LLM context and command execution.