new-project-onboarding

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a real, non-placeholder password in assets/install_mariadb_with_docker.txt: the environment variables MARIADB_ROOT_PASSWORD and MARIADB_PASSWORD are set to "Admin_1jj395qu". This is a literal credential (used to run a MariaDB container) and appears to be a specific, moderately high-entropy password granting database access, so it should be treated as a secret.

Ignored items: evals/files/sample-project/.env.example contains DATABASE_URL="mysql://user:password@..." and BETTER_AUTH_SECRET="change-me" — these are obvious placeholders/low-entropy setup values and are not flagged.