user-thoughts

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires preserving raw user wording verbatim and writing it into project-local files (and shows commands that append user-provided text), so if a user supplies secrets or API keys the agent is instructed to reproduce and persist them exactly, creating a high exfiltration risk.