workflow-scan

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill requires scanning and reporting file-level evidence from the temp project (scripts, commands, skill/hook files, etc.) into WORKFLOW_QUESTIONS.md but gives no instruction to avoid or redact literal credentials, so the LLM may be compelled to read and include secret values verbatim in findings.