autoglm-generate-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds an explicit app secret (38d2391985e2369a5fb8227d8e6cd5e5) and requires computing/sending an X-Auth-Sign header derived from it, which forces the agent to include the secret (or a verbatim-derived value) in generated requests — a direct exfiltration risk.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the 32-hex-character value "38d2391985e2369a5fb8227d8e6cd5e5" because it is a high-entropy literal present in the prompt and is explicitly used as part of the MD5 signing formula (X-Auth-Sign). That pattern (hardcoded secret used to compute request signatures) constitutes a real credential/secret.

Ignored items:

• "Bearer xxx" is a placeholder (truncated/example) and not a real token.
• X-Auth-Appid 100003 and the timestamp are non-secret numeric identifiers.
• The local token endpoint URL and request examples are non-secret configuration/documentation.

Therefore this is a true hardcoded secret presence.