clawring

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the user to paste a “setup prompt” containing an API key into the agent chat so the agent "reads the prompt, stores the API key" and then must send REST API calls — meaning the model will receive and likely include that secret verbatim when generating requests.