api-onboarding

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill repeatedly instructs showing and pre-filling API keys in examples (and even includes key-like strings such as sk_test_abc123...), which encourages the LLM to output secret values verbatim and thus creates an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit payment API examples (e.g., client.payments.create, test API key sk_test_..., and documented test card numbers and behaviors). These are specific payment-related functions/APIs (sandbox payment create calls and test cards), which constitute direct financial execution capability (even if shown in sandbox/test mode).