hap-apiv3-data

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the AI to read MCP configuration files, extract AppKey/Sign or Bearer tokens, and then insert or log those exact credentials into API request headers or console output, which requires the LLM to handle and potentially emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Contains explicit instructions and code for the AI to automatically read local editor/MC P configuration files and extract API credentials (AppKey/Sign/Bearer tokens), which enables unauthorized credential access and data exfiltration.