llm-top-10

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to grep for hardcoded secrets (detection) and include code snippets/config excerpts as "Evidence" in findings, which encourages reading and potentially outputting secret values verbatim — creating an exfiltration risk unless redaction is enforced (which the skill does not require).