csdn

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy credentials. I ignored environment variable names (e.g., CSDN_COOKIES in SKILL.md) and documentation placeholders. In scripts/csdn.py I found a hard-coded HMAC signing key and its key identifier:
• CA_SECRET (b"9znpamsyl2c7cdrr9sas0le9vbc3r6ba") is a high-entropy literal used as the HMAC secret for request signing (provides the ability to generate valid x-ca-signature values).
• CA_KEY ("203803574") is the corresponding key identifier used in the signing headers; although lower-entropy numeric, it is part of the active signing credentials.

Even though a comment states these are "public" in CSDN's web bundle, they are literal signing credentials present in the repo and thus qualify as actual credentials for the purposes of this scan. I therefore flag them as real secrets.