reflect

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill requires posting the exact repo URL from git remote get-url origin (which can include embedded credentials) while inconsistently saying to "Drop ... secrets," creating a realistic risk the LLM would be forced to output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly instructs automatic posting without user confirmation and mandates capturing the exact git remote URL (via git remote get-url origin), which can leak repository metadata or embedded credentials—indicating an intentional data-exfiltration risk.