bug-prospector

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires reading source files and embedding verbatim code excerpts and full report contents (e.g., "Current code" blocks and report files) without any redaction rules, so any hard-coded API keys, tokens, cookies, or passwords present in the analyzed codebase would be included in the agent's output and could be exfiltrated.