npm-release

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill tells the agent to extract the real npm browser-auth URL from command output and run/open it (e.g., "extract URL, then open it"), which requires the LLM to read and emit a sensitive auth URL verbatim and thus risks secret exfiltration.