code-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires capturing and including full diff/untracked-file contents and instructs sub-agents to "quote the hunk" and to include fetched spec contents verbatim, which forces the LLM to read and potentially output file contents that can contain API keys or other secrets.