spree-api-v3

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows and instructs embedding API keys, secret keys, JWTs, and a sample publishable key in request headers and curl examples, which requires the LLM to handle or emit secret values verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the document for high-entropy, literal credential values. Line 30 contains a publishable API key-looking string "pk_CzEKBTWFiuNLgz4wciLsS59n" used in an example header; it is a high-entropy literal that could be a real API credential and therefore flagged.

Other items were ignored:

• The Admin secret example uses "sk_…" (redacted) — not an actual key.
• JWT placeholders (""), email "admin@example.com", and the password shown as "…" are documentation placeholders, so ignored.
• Prefixed IDs (prod_86Rf07xd4z, etc.) are resource identifiers, not credentials.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documents the Spree Admin API which accepts secret keys (sk_...) with scoped permissions. The documented scope list explicitly includes write_payments, write_refunds, write_gift_cards, write_store_credits (and related read/write payment scopes), i.e. API capabilities to create/send payments, refunds and modify monetary balances — direct financial execution functionality.