csdn

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected both files for literal, high-entropy values that could grant access. The script contains a hard-coded HMAC secret (CA_SECRET) used to sign requests; it is a random-looking byte string and is therefore a real credential. I am not flagging environment variable names (CSDN_COOKIES) or simple IDs (CA_KEY is a numeric ID, not high-entropy) since those are either names/IDs or low-entropy and not secrets. There were no documentation placeholders, redactions, or other obvious false positives to consider.