Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The skill instructs users to supply an API secret key in headers or request bodies but provides no warning that the value is a credential requiring careful handling. In an agent-skill context, this omission increases the chance that users or calling agents will place the secret in prompts, logs, transcripts, examples, or shared configs, leading to credential disclosure and unauthorized API use.
