online-evals

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit curl examples and code that place an API token directly into Authorization headers and instructs prompting the user for a token if env-detection fails, which requires the agent to receive and/or emit secret values verbatim (high exfiltration risk).