setup-notifications-via-wecom

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes explicit commands and curl examples that embed the WeCom webhook URL (a secret API key) directly into shell commands/config (echo to config.json and curl with ?key=...), which encourages the agent to output or handle the secret verbatim rather than keeping it only in local environment variables or a tool-managed credential store.