product-experience-officer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly tells the agent to read entry-point files (README, install.sh, docker-compose, etc.), capture verbatim CLI transcripts and UI copy, and "quote copy verbatim in findings," which can force the LLM to include secret values (API keys, tokens, passwords) present in those files or transcripts in its output — an exfiltration risk.