expo-skill-feedback

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal high-entropy PostHog project key in telemetry_common.cjs. It is a non-placeholder, phc_-prefixed API key (random-looking string) assigned directly to POSTHOG_PROJECT_API_KEY. Although the file comment says this write-only/public ingestion key is safe to commit, by the definition given a literal API key that provides access to a service is considered a secret and should be flagged. No other high-entropy credentials or private keys are present; remaining values are config names, comments, or obvious placeholders.