byted-kickart-game-replicator

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Multiple files contain explicit instructions to solicit users' AK/SK via chat, commands that print or persist sensitive credentials, and code paths that log or automatically re-upload generated media — patterns that enable credential theft and unintended data exfiltration.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal high-entropy credentials. Most occurrences are placeholders (env var names like KICKART_ACCESS_KEY, X_MUSE_TOKEN, example template IDs, numeric task IDs) or documentation examples and were ignored per the rules.

I flagged one high-entropy value that appears to be an access signature embedded in an example result URL:

• The "result_url" in references/kickart接口协议.md contains an x-signature query parameter (OL2UIrJSV5nguLdkPlL61k87aME%3D → decoded: OL2UIrJSV5nguLdkPlL61k87aME=). This is a long, random-looking signature that grants access to the resource (signed URL). It meets the definition of a secret (high-entropy literal that provides access), and is not a generic placeholder or simple example value, so I treat it as a secret to be flagged.

No private key blocks, API key strings (sk-...), or other high-entropy credentials were found elsewhere.