adversarial-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs embedding the full "code or diff" into a CLI prompt string (e.g., codex exec "prompt" and claude -p "prompt"), which forces the agent to include any secrets from that code verbatim on the command line and in generated prompts/output, creating a high exfiltration risk.