ara-rigor-reviewer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt mandates quoting exact substrings from artifact files into the generated report (the required evidence_span), so if those files contain API keys/passwords/cookies the agent would be forced to output them verbatim, creating an exfiltration risk.