expo-skill-feedback

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I searched the skill files for literal, high-entropy credentials. The only candidate that meets the "real, usable credential" definition is the PostHog project API key defined in scripts/telemetry_common.cjs. It is a long, random-looking string (phc_w8xRytdAAwkV3oExnuUozqH64PMzCmDLnyoChpPBcNXs) assigned directly to POSTHOG_PROJECT_API_KEY, so it is a literal credential present in the repo.

Note: the file comment states this is a write-only/project ingestion key (committed intentionally and safe to embed), but per the scanning rules it is still a literal, high-entropy API key and therefore flagged. Other values in the repo are documentation placeholders, environment variable names, or example dry-run redactions (e.g., "phc_...") and were ignored.