api-design

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes literal secret-like strings (a JWT-like bearer token and an sk_live API key) which are examples of sensitive credentials that should not appear verbatim in prompts or be echoed — even though the skill doesn't explicitly ask the LLM to solicit user secrets, embedding such tokens is an insecure pattern that risks exfiltration or misuse.