to-spec

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill mandates reading and extracting exact facts from repository files (using grep/cat and producing line‑anchored "key facts" and claim→source mappings) without any redaction rules, so any secrets present in those files could be included verbatim in the spec output — creating a high exfiltration risk.