api-documentation

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a high-entropy literal refresh token present in the docs: "fdb8fdbecf1d03ce5e6125c067733c0d51de209c". It appears verbatim as a refresh_token in example request/response JSON and is not a placeholder, truncated value, or a clearly low-entropy example password — so it meets the definition of a secret.

I ignored other values that look like potential matches for these reasons:

• Truncated JWTs like "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." contain "..." (redacted/truncated) -> ignore.
• Placeholders such as YOUR_TOKEN, YOUR_API_KEY, sk-xxxx, {{access_token}} -> ignore.
• Low-entropy/example values (usr_123abc, SecurePass123!, sess_xyz789, open/example passwords) and environment variable names -> ignore.