dot-openapi

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The Authentication section explicitly shows an Authorization: Bearer dot_app_<your_api_key> header template, which requires embedding a user API key verbatim in requests or generated examples, creating an exfiltration risk.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a literal, high-entropy API key in references/authentication.md. The string on line 28 (dot_app_UlSpzXNEXhYZIAFakHLCkMVVBLbsBIWxaRMVaJZGUOYKhDoDRZwLLvLujAIwQxbY) appears to be an actual API credential (random-looking, long), so it meets the secret definition.

I am ignoring all documentation placeholders such as "dot_app_<your_api_key>" and export examples like export DOT_API_KEY="dot_app_<your_api_key>" that appear elsewhere (these are clearly placeholders). No other high-entropy literals, private keys, or credentials were found.