[yashrajp22]

Follow-up to #827. A skill-card field such as Credential Type(s): [Read Perforce access credentials] could hide a real credential-access finding. Keep the original fix for harmless credential disclosures, while retaining findings for credential reads, acquisition, storage and transfer instructions inside the field.

The new guard stays within the existing 4,096-character field limit and leaves the shared OAuth checks unchanged. Exact adjective compounds such as read-only and open-source remain harmless before or after credential, secret and token nouns; actual actions and sensitive paths still remain visible.

Validation:

• 991 targeted and adjacent regression tests pass from source and again from a fresh installed wheel.
• 32 CLI scans across eight focused skill cases reproduce the baseline problems and verify the fix in source and wheel modes.
• 48 scans across 12 complete sample skills preserve source/wheel results and unrelated findings.
• Fresh wheel/sdist builds, package-resource checks, Ruff and both independent secondary reviews pass.

All scan checks used offline static analysis; no live-provider behavior is changed or claimed.