auth-token-manager

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds literal secrets (default MIKOPBX_PASSWORD, example JWT and POST body with password) and shows commands that include tokens/passwords verbatim, so an agent following it would be required to handle/output sensitive values directly.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains literal, usable credentials:
• The JWT string (eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9....SOP3FAXD-...) appears verbatim in SKILL.md/README as a full header.payload.signature token. This is a high-entropy bearer token and would grant API access if still valid — therefore it is a secret.
• The default password MIKOPBX_PASSWORD="123456789MikoPBX#1" appears in SKILL.md, README.md, and get-auth-token.sh. This is a specific, non-placeholder password (mixed digits/letters/symbol) and qualifies as a hardcoded credential. (MIKOPBX_LOGIN="admin" and the API URL are low-entropy / non-secret and are ignored.)

No private keys or other API keys were found. No placeholders or redacted values are being flagged.