migrate-to-skills

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt instructs the agent to read file contents and write them verbatim into new skill files (including under the user's home), so any API keys, tokens, or passwords present in those files would be reproduced in the agent's output—creating an exfiltration risk.