supply-chain-audit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires reading and printing file contents verbatim (e.g., .npmrc and workflow YAMLs) and showing unified diffs, which will force any embedded secrets (auth tokens in .npmrc, leaked secrets in workflows, etc.) to be included verbatim in the agent's output.