nextjs-security-scan

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt instructs the agent to read repository files including .env* and to emit "evidence" snippets for findings, which can require copying secret-bearing lines (API keys, tokens, passwords) verbatim into the report, creating an exfiltration risk.