token-audit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's audit commands explicitly read and print environment/settings entries (e.g., ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY via env|grep and jq printing "key=value"), which would expose secret values if run — an exfiltration risk even if the final table doesn't require the verbatim secrets.