Credentials Are Leaked by LLM Agent Skills: An Empirical Study