guidewright-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.85). The skill explicitly tells the agent to "Get login credentials and the environment URL from the user" to run live UI walks, which requires the LLM to receive secrets and likely pass them to the browser-driving MCP or include them in actions/output, creating an exfiltration risk.