webapp-pentest-checklist

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The checklist requires replaying authenticated requests and explicitly asks the user to provide two test accounts (sessions/credentials), which means the agent would need to accept and embed session cookies or auth tokens verbatim in probes, exposing secrets through its outputs.