The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.

Why it was flagged

The skill's examples and steps explicitly instruct including an "Authorization: Bearer <access_token>" header in curl/HTTP requests, which requires the agent to insert the actual access token verbatim into generated commands/requests, creating an exfiltration risk.

Where we found it

<access_token>

secret · 3 sites

The skill explicitly instructs including an Authorization: Bearer <access_token> header in curl commands at three locations, requiring the agent to substitute a real access token that would be emitted in command lines.

SKILL.md

- `Authorization: Bearer <access_token>`

SKILL.md

-H "Authorization: Bearer <access_token>" \

SKILL.md

-H "Authorization: Bearer <access_token>"

Report incorrect finding

Audited: 6 months ago
Security analysis