secrets-detection

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes explicit secret-like values (e.g., "sk_live_actual_key_12345" and "DB_PASSWORD=actual_password") and patterns for real API keys/tokens, which would require the LLM to reproduce or handle secrets verbatim if it echoes those examples—this is high-risk secret handling.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The .pre-commit-config.yaml lists remote hook repositories such as https://github.com/gitleaks/gitleaks which pre-commit will fetch and install at runtime, causing execution of code from those URLs.