telegram-dm

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, high-entropy credentials.

Flagged:

• TG_API_HASH="0123456789abcdef0123456789abcdef" — this is a 32‑hex-character literal that matches the format and entropy of a real Telegram api_hash. It is presented as an environment variable value in an example, and if it were real it would grant access, so it should be treated as a secret.

Ignored (not flagged) with reasons:

• TG_API_ID="123456" — low-entropy numeric example; documentation/example value.
• TG_PHONE="+8613800138000" and other phone numbers — example phone numbers / low-sensitivity placeholders.
• Any occurrences of "session_data": "" or session strings shown as "eyJhY2..." (truncated with ellipsis) — truncated/redacted placeholders per rules.
• SESSION="<session_data>" and other placeholders, plus obvious example credentials in sample commands — documentation placeholders or low-entropy examples and therefore not considered real secrets.
• No PEM/private-key blocks or other literal high-entropy tokens were found elsewhere.

Conclusion: one high-entropy-like literal (TG_API_HASH) present; everything else is a placeholder/example or low-entropy and ignored.