init-project

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt instructs the agent to ask the user for secrets/API keys (like database connection strings, Stripe keys, Resend keys, and Anthropic keys) and then programmatically substitute those raw secret values into a Node.js script using string replacement (PASTE_VALUE) to write them to a local .env file. This pattern forces the LLM to process and handle user-provided secrets directly in its context and output.