audit-codebase

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs scanning commands (grep patterns for API keys/tokens and provider-specific regexes) and asks for findings with file:line references, which will cause secret values found in code to be read and included verbatim in the agent's output — creating a high risk of secret exfiltration.