best-practices-agent

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes literal API bearer tokens in example code (e.g., "Authorization: Bearer sk-dev-proxy-123") and shows HTTP requests with Authorization headers, which requires emitting secret values verbatim in generated code/commands — an exfiltration risk.