Intent-Code Divergence
Medium
- Confidence
- 97% confidence
- Finding
- The skill says no extra API key is needed, but then instructs users to enable `git config --global credential.helper store`, which persists repository credentials in plaintext on disk. This can expose tokens or passwords to other local users, malware, backups, or accidental disclosure, especially in shared or managed environments.
