work-refute

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires refuters to "quote the real, current lines" from cited files and to "report the result with the exact command + output" (and include those quotes in the JSON evidence), which forces the LLM to include any secrets or credentials present in files or command outputs verbatim in its responses — a direct secret-exfiltration risk.