workflow

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to read $CLAUDE_SESSION_ID (or derive a short UUID) and then embed that session ID verbatim in calls and filenames (e.g., workflow_session_start and state file names), which requires the LLM to handle and output a sensitive session token.