api-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to read target files and include "before" code blocks in the report (saved as an artifact) without instructing redaction, so any secrets present in the reviewed files (hardcoded keys, tokens, passwords, cookies) would be reproduced verbatim in the output and artifacts, creating a high exfiltration risk.