source-code-hunting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). Insecure: the skill explicitly directs extracting and decoding hard-coded/obfuscated secrets (mentions sk-/ghp_/BEGIN RSA, JS deobfuscation to get plaintext API paths/config) and using tools like trufflehog/gitleaks to retrieve credentials, which requires handling and likely outputting secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The file is a playbook describing how to locate and extract sensitive data (git history, hardcoded keys, bundles), decode obfuscated JS, and exploit supply-chain/CI vectors (GHA command injection, self-hosted runner takeover), which directly enable data exfiltration, remote code execution and credential theft.