jotbird-publish

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains an apparent live Bearer API key hardcoded in the example (SKILL.md:10), which exposes a secret in the prompt and creates a high exfiltration risk even though the instructions say to use an env var.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a literal, high-entropy API key value assigned to JOTBIRD_API_KEY: export JOTBIRD_API_KEY="jb_c57e765852df55f32daa0f8c745b3241552a052ddfbe1907f73a4d67d107fe4b"

This is not a placeholder (e.g., YOUR_API_KEY) nor a low-entropy setup password — it is a long, random-looking token that could be used to access the service, so it meets the definition of a secret and should be flagged.