html-comparison-matrix

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly tells the agent to capture the per-session URL returned by the html-skills-listen tool and inject that exact URL string into the generated HTML as window.CLAUDE_SUBMIT_URL, requiring the model to emit a tool-returned (secret-like) value verbatim in its output.