security-review
When the user needs a security assessment — threat modeling, vulnerability review, auth flow audit, dependency scanning, or says "is this secure", "review for vulnerabilities", "threat model", "security audit", "pen test prep".
83
83%
Does it follow best practices?
Impact
86%
1.30xAverage score across 3 eval scenarios
High
Do not use without reviewing
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The prompt explicitly instructs scanning for hardcoded credentials and includes an example finding that prints a hardcoded JWT secret ("supersecret123"), which requires the LLM to handle and output secret values verbatim.
- Repository
shawnpang/startup-founder-skills
- Revision
4ad31b4
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.