tencentmap-miniprogram-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to accept and "record" a user's formal API Key (or read it from env/interaction) and then continue processing (including using the key), which requires the LLM to handle and potentially embed the secret verbatim in generated code/requests—an exfiltration risk.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repo for literal credentials. I found the same WeChat mini-program AppID string "wx7fa449c6a5a22a95" embedded verbatim in multiple example project.config.json files. This value is not a placeholder like "YOUR_KEY" — it is a concrete, non-trivial identifier (appears to be a real wx AppID) and therefore qualifies as a literal credential/identifier that could be linked to an app/project. I treat such embedded app IDs as sensitive because they can assist discovery/targeting of a live application and may be usable in some development workflows.

I ignored obvious placeholders and demo tokens that are not real secrets:

• "YOUR_KEY", "YOUR_FORMAL_KEY", "YOUR_KEY" in example code — documentation placeholders (ignored).
• key: 'none' in the "experience" code path — intentionally used as a placeholder for the experience mode (ignored).
• Other example strings like '开发密钥（key）' or 'YOUR_*' are clearly placeholders or sample values and were not flagged.

Therefore I flag presence of the AppID occurrences as potential leaked credentials.