Skill Crossroads

✗ SAFETY-01 No hardcoded secrets

SKILL.md:120— → matches Assigned credential literal pattern

Possible hardcoded secret (Assigned credential literal) — Pass***********************!'

Pass***********************!'

SKILL.md:159— → matches JSON credential assignment pattern

Possible hardcoded secret (JSON credential assignment) — 'PAS****************d'

'PAS****************d'

auth-flows.md:20— → matches Assigned credential literal pattern

Possible hardcoded secret (Assigned credential literal) — pass*************d'

pass*************d'

auth-flows.md:39— → matches JSON credential assignment pattern

Possible hardcoded secret (JSON credential assignment) — 'PAS****************d'

'PAS****************d'

auth-flows.md:97— → matches JSON credential assignment pattern

Possible hardcoded secret (JSON credential assignment) — 'cli**************************T'

'cli**************************T'

auth-flows.md:326— → matches JSON credential assignment pattern

Possible hardcoded secret (JSON credential assignment) — "cli*********************************t"

"cli*********************************t"

Fix Remove the secret from source, rotate it, and reference it via an environment variable instead.

✗ VERIFY-01 Evals or tests present

SKILL.md:1the skill works → no evals/, tests/, or verification section found

No way to prove the skill does what it claims.

Fix Add an evals/ folder (test prompts + expected outcomes) and a '## Verify' step in the body.

Top fixes — ranked by score impact