sprites

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt explicitly embeds a real-looking API secret (7a4b2ef1a7b209016ce2670b6b01fc3066a3553bfae0b0745aaf44266dba724c) directly in the file context under Project Context, exposing it to any LLM parsing the instructions.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a high-entropy hex string explicitly labeled as a "Real API key" under the Project Context section (7a4b2ef1a7b209016ce2670b6b01fc3066a3553bfae0b0745aaf44266dba724c). This is an active, leaked secret rather than a placeholder.