api-security-scan

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt asks the agent to scan specs and report file:line and to flag "Secrets in examples" (real keys/tokens), which encourages including or exposing secret strings verbatim in the report and thus creates an exfiltration risk.