llm-council

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to scan and load local workspace files (e.g., CLAUDE.md, memory/ folders, recent transcripts) and to embed "key workspace context" and file contents into the framed question, transcript, and a JSON payload that is saved and rendered—so any secrets (API keys, tokens, passwords) found in those files would be included verbatim in outputs and saved artifacts, creating a clear exfiltration risk.