dot-device-openapi

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to obtain an API key from the user (or environment) and use it in an Authorization: Bearer header, which requires the LLM to handle or embed the secret value verbatim in requests or generated output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a literal, high-entropy API key found in the docs. The value "dot_app_UlSpzXNEXhYZIAFakHLCkMVVBLbsBIWxaRMVaJZGUOYKhDoDRZwLLvLujAIwQxbY" is a real-looking bearer token (not a placeholder like dot_app_<your_api_key>), so it meets the definition of a secret.

I ignored other instances of placeholders and examples (e.g., "dot_app_<your_api_key>", "DOT_API_KEY", or guidance text that instructs how to set the key) because they are documentation placeholders or environment-variable names per the ignore rules.