moai-ref-owasp-checklist

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The checklist's verification step explicitly asks to "show grep results for common secret patterns" and specifies displaying API key fragments (masked first 4 chars), which requires locating and outputting secrets or secret-derived strings verbatim and therefore risks secret exfiltration.