cosmosdb-tooling
Fail
Audited by Snyk on Jun 17, 2026
Risk Level: HIGH
Full Analysis
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). I found a high-entropy, literal credential in multiple places: the Cosmos DB emulator master key value C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==. This is a usable key (it grants access to the emulator) and is not a placeholder or environment-variable name, so it meets the definition of a secret (high-entropy literal value that provides access).
Notes on ignoring other items:
- ${COSMOS_KEY} is an environment variable reference — ignored per rules.
- Example endpoints (https://localhost:8081/ and https://my-prod-account.documents.azure.com:443/) and commands (install/cp) are not secrets or are placeholders.
- The emulator key is a well-known default for the local Cosmos DB emulator (public in Microsoft docs). It still is a literal, high-entropy credential in the text and therefore flagged per the scanning criteria.
Issues (1)
W008
HIGHSecret detected in skill content (API keys, tokens, passwords).
Audit Metadata