trace-trade-flows

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly requires an API key in the X-WorldMonitor-Key header and even embeds a literal-looking API key in the doc, which forces or tempts the agent to handle or reproduce secret values verbatim (high exfiltration risk).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The value on SKILL.md line 12 is a literal, high-entropy API key string (prefix "wm_" followed by long hex-like characters). It is not a generic placeholder (e.g., YOUR_API_KEY) nor a simple setup password, so it qualifies as a real credential present in the documentation. No other high-entropy secrets are present in the provided files.