freemius-core

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to ask makers to paste secret/API keys into a single block and explicitly to "restate: detected state + the values just provided", which requires the LLM to receive and echo secret values verbatim (high exfiltration risk).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The Skill is explicitly a payment integration: it instructs installing and constructing the Freemius payment SDK (including secretKey/apiKey), creating hosted/overlay checkouts via freemius.checkout.create(), handling purchase retrieval (purchase.retrievePurchase) and webhooks, and wiring live vs sandbox payment flows. These are specific APIs for accepting and processing payments (moving money), not generic tooling.