track-tariff-trends

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill embeds a literal-looking API key (wm_0123456789abcdef...) and mandates placing an API key in the X-WorldMonitor-Key header, which encourages including secret values verbatim instead of using env vars or secure auth flows.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Line 12 contains a literal API key-like value: "wm_0123456789abcdef0123456789abcdef01234567". It is a high-entropy, non-placeholder string with a vendor prefix (wm_) followed by a long hex sequence and therefore qualifies as a secret. The curl example uses an environment variable ($WM_API_KEY) which is a placeholder/usage example and not flagged.