synapse-client

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). SynapseClient connects at runtime to NATS endpoints (e.g., nats://localhost:4222 and the example tls://connect.ngs.global:4222) and consumes JSON "request" envelopes from those servers which directly carry instructions/tasks that can control the agent's behavior.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, high-entropy credentials that would grant access.

Flagged:

• The example raw NKey seed shown in client.connect doc: "SUAS52LXLHT7O5Y6MYUS7VKK2UAKPDKMFJEJENBAPQOGOXY7BNQXYXTQ" This is a long, random-looking seed string (high entropy) that would be usable as an NKey seed if real, so it meets the definition of a secret.

Ignored (not flagged) with reasons:

• "nats://admin:s3cret@host:4222" — password "s3cret" is short/low-entropy and clearly a documentation example (setup/example password) → ignore.
• Password fields shown as "" or "" in nats.conf — placeholders / examples → ignore.
• Paths to creds/seed files (e.g., "/.nats/synadia.creds", "/.synapse/nkeys/*.seed", "/etc/nats/synadia.creds") — these are filenames/paths, not secret values → ignore.
• Truncated/redacted values or ellipses in examples (e.g., "0192…", "eyJ...") — truncated/redacted → ignore.
• Any environment variable names, sample GUIDs, or simple example strings (e.g., "openclaw", "admin", "SecurePassword123!") — documentation examples/low-entropy → ignore.

Only the explicit high-entropy seed string above appears to be a real credential embedded in the docs and thus is reported.