cli-cost-usage

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt documents a CLI that accepts API keys via a --api-key flag (and similar flags), which encourages embedding secret values directly into generated command lines and would require the LLM to include those secrets verbatim if asked to produce example commands.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a cost/pricing/usage management CLI and contains commands that modify financial settings — notably "usage set " (with scope/period) to change budgets/limits and "pricing set" to change pricing configuration. These are explicit APIs to update spending/budgeting, which fits the guidance to flag tools that can manage budgets or alter financial execution settings. Therefore it grants direct financial execution capability (budget/financial-setting changes), not merely read-only or generic actions.