gpon-sfp-onu-stick-expert

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt embeds a plaintext SSH password (7sp!lwUBz1) and management IP and instructs interactive SSH/config workflows that could require echoing or embedding that secret, so the LLM would handle/output secret values verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a hardcoded, specific SSH password in the Default Access section: 7sp!lwUBz1. This is a literal credential (10 characters with mixed-case, digits, and punctuation) that appears usable for SSH access and meets the "high-entropy, literal value" definition, so it should be flagged. Other items (ONTUSER username, 192.168.1.10 management IP, serial settings, and file/path names) are not secrets per the policy (they are usernames, IPs, or documentation references) and are ignored.