performing-security-code-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs scanning for hardcoded secrets and requires including code snippets in the report, which would cause the model to output secret values verbatim (e.g., API keys or plaintext passwords) — a direct exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository contains intentionally vulnerable example code that includes high-risk constructs (insecure deserialization that encodes a pickled payload which would execute rm -rf / if deserialized, base64-encoded payloads, command injection via shell=True, and other deliberate unsafe patterns) — dangerous if executed or copied into production.