check-sanctions-pressure

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires presenting an API key in the X-WorldMonitor-Key header and even includes a literal-looking API key string in the docs, which forces agents to handle/output secret values (high exfiltration risk).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Line 12 contains a high-entropy, literal API key-like value ("wm_0123456789abcdef0123456789abcdef01234567"). It is not a documentation placeholder (e.g., YOUR_API_KEY) nor a simple setup password, and it could be a usable API key pattern (prefix + long hex string). The environment variable reference ($WM_API_KEY) is not flagged because it does not contain a value.