sales-prestashop

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill repeatedly shows and recommends embedding the PrestaShop API key directly in example curl/command lines (e.g., curl -u "KEY:"), which would require the LLM to copy any user-provided key verbatim into generated commands or code, creating an exfiltration risk.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a 32-character, high-entropy API key literal (not a generic placeholder) that appears verbatim in multiple example/code blocks. It looks like an actual PrestaShop Webservice key (username for HTTP Basic) rather than a named placeholder (e.g., YOUR_API_KEY or $PS_KEY). Because it is a concrete credential value present in the docs, it meets the definition of a secret to report.