pdf-ocr-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill requires a cloud API key for the SiliconFlow engine and the prompt includes examples asking the assistant to request the user's API key (and shows it placed in .env), which could cause the LLM to receive and embed secret values verbatim in requests or responses—so there is a significant secret-exfiltration risk.