raycast-extensions

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Contains a hardcoded API key (with gitleaks suppression) that is sent to an external endpoint — an intentional credential-exposure / scanner-evasion pattern that enables misuse or exfiltration.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Found a hardcoded, high-entropy API key literal in the fixture. The value (dict_live_sk_8f3a9b2c1d4e5f6a7b8c9d0e) is a random-looking token (sk-like pattern) stored directly in source — qualifies as a secret per the policy. Although the file comment says "Not a real credential" / "deliberately planted", that does not change that a literal credential-format token is present and should be flagged.