scientific-slides

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly documents a --api-key CLI option (allowing API keys to be passed on the command line) and shows an export of OPENROUTER_API_KEY, which creates a realistic path for secrets to be provided and potentially echoed or embedded verbatim by the agent — an insecure pattern if the LLM is asked to emit or construct commands containing the real key.