compdf-compress-pdf

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for literal, high-entropy credentials and ignored obvious placeholders (e.g., "YOUR API-KEY", "apiKey", "{{apiKey}}"), truncated/redacted values, and example UUIDs/taskIds. I found a 32-hex webhook signature presented as a concrete header value in the webhook example (ComPDF-Signature: 8fef357511abec47a4a22313c1dcdb8b) and the matching webhookToken JSON value. This is a high-entropy literal token (not an obvious placeholder) and could be used to verify webhook authenticity, so I flagged it. All other occurrences looked like placeholders, sample headers, or non-credential IDs and were not flagged.