suparank/publish

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill reads credentials from local files and instructs the agent to construct and run curl/JS commands that embed secrets (Basic auth base64 with app_password, Ghost admin_api_key in a node one-liner, fal_api_key in Authorization headers), which requires the LLM/agent to handle and output secret values verbatim — a high exfiltration risk.