ktx-ai-data-agents-context-layer
Fail
Audited by Snyk on Jun 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). I scanned the document for literal credentials. I did NOT find any API keys, private keys (PEM blocks), or other obvious high-entropy secrets embedded in config values — most values are placeholders or environment-variable names and/or low-entropy example passwords:
- ANTHROPIC_API_KEY=your-key-here, OPENAI_API_KEY=your-key-here, GOOGLE_CLOUD_PROJECT=your-project — placeholders (redacted/example), ignore.
- DB_USERNAME=readonly_user and DB_PASSWORD=secure-password — example/low-entropy setup values; per rules these are documentation examples, not flagged.
- NOTION_API_KEY=secret_xxx and NOTION_DATABASE_ID=xxx — clearly placeholder/redacted values, ignore.
- Many other mentions are environment variable names (e.g., KTX_TELEMETRY_DISABLED, DB_USERNAME environment variable names) or model names (claude-sonnet-4-6) — not secrets.
However, the Slack invite URL in Resources: https://join.slack.com/t/ktxcommunity/shared_invite/zt-3y9b44m1x-LVyNNJD5nwaZHq4XS29LMQ contains a long, high-entropy invite token (zt-3y9b44m1x-LVyNNJD5nwaZHq4XS29LMQ). That token is a literal, high-entropy value that can grant access (join) to the Slack workspace and therefore qualifies as a secret per the provided definition. This is the only string in the document that appears to be an actual, usable token rather than a placeholder or low-entropy example.
Issues (1)
W008
HIGHSecret detected in skill content (API keys, tokens, passwords).
Audit Metadata