square-post

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks the agent to prompt the user for an X-Square-OpenAPI-Key, store that key in the skill's Accounts section, and include it in API requests (example curl shows the header), which requires the LLM to receive and embed the secret verbatim—an exfiltration risk.