mcp-server-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs storing real credentials in ~/.devcontainer-state/ai/mcp/servers.json, tells agents to copy/merge that file into agent settings, and even shows an inline test using ENV_VAR=value — all of which require the agent to handle and could force it to output secret values verbatim.