monitor-supply-chain-stress

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires an API key in the X-WorldMonitor-Key header and embeds a literal API-key-looking string (wm_0123456789...), which means an LLM could be expected to include secret values verbatim in generated requests or examples.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal API key shown in the Authentication code block. The value "wm_0123456789abcdef0123456789abcdef01234567" (line 10) is a concrete, high-entropy-style API token (prefix + long hex-like string) rather than a placeholder like "YOUR_API_KEY", so it meets the definition of a secret. The environment variable usage ($WM_API_KEY on line 53) is just a variable reference and is intentionally ignored.