compdf-ocr

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the ComPDF webhook signature because it is a literal, high-entropy token (hex-like string) present in the docs and appears to be an authentication/signature value (ComPDF-Signature / webhookToken). This fits the definition of a secret (a token that could be used to validate or spoof webhook requests) and is not a clear placeholder like "YOUR_API_KEY" or "{{apiKey}}".

I ignored other values such as "YOUR API-KEY", "apiKey", "{{apiKey}}", and UUIDs (e.g., taskId examples) because those are documentation placeholders or identifiers (low risk / not usable credentials) per the rules.