generate-appworld-code

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires generated code to include plaintext credentials (e.g., username="user@example.com", password="password") and to pass access tokens as literal parameters, forcing the model to output secrets verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes AppWorld Venmo API calls that perform payments (e.g., apis.venmo.send_payment(access_token=..., recipient_id=..., amount=...)). It also includes friend-management patterns (apis.venmo.add_friend/remove_friend) and login/token usage for Venmo. These are specific payment-related APIs (direct financial execution), not generic tooling. Therefore it grants direct financial execution capability.