cosmosdb-tooling

Fail

Audited by Snyk on Jun 17, 2026

Risk Level: HIGH
Full Analysis

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

  • Secret detected (high risk: 1.00). I found a high-entropy, literal credential in multiple places: the Cosmos DB emulator master key value C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==. This is a usable key (it grants access to the emulator) and is not a placeholder or environment-variable name, so it meets the definition of a secret (high-entropy literal value that provides access).

Notes on ignoring other items:

  • ${COSMOS_KEY} is an environment variable reference — ignored per rules.
  • Example endpoints (https://localhost:8081/ and https://my-prod-account.documents.azure.com:443/) and commands (install/cp) are not secrets or are placeholders.
  • The emulator key is a well-known default for the local Cosmos DB emulator (public in Microsoft docs). It still is a literal, high-entropy credential in the text and therefore flagged per the scanning criteria.

Issues (1)

W008
HIGH

Secret detected in skill content (API keys, tokens, passwords).

Audit Metadata
Risk Level
HIGH
Analyzed
Jun 17, 2026, 08:15 PM
Issues
1
Security Audit — snyk — cosmosdb-tooling