api-campaign-builder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes concrete curl/Python examples that put the team API key directly into request headers and explicitly instructs the agent to "always show the full curl or Python" (not pseudocode), which encourages embedding any provided API key verbatim into outputs — creating an exfiltration risk.