review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires the reviewer to "quote the offending snippet" (path:line) for FAIL/UNKNOWN axes and to list concrete remediation bullets with path:line, so if a diff contains hardcoded API keys/tokens or env reads the agent would be forced to reproduce secret values verbatim in its output.