ask-matt

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The /wizard skill explicitly tells the agent to "open each URL, capture each value, and write it into .env and GitHub secrets," which requires collecting sensitive credentials and would cause the LLM to handle or embed secret values verbatim if implemented that way.