pubmed-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask the user for their Valyu API key and then embed that key verbatim into a shell command (e.g., scripts/search setup <api-key> and the example with val_abc123...), which requires the LLM to handle and output secret values directly, creating an exfiltration risk.