autoglm-search-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains an explicit API secret and instructs fetching a Bearer token from a local endpoint and including it (and computed signature headers) in API requests, which requires the agent to handle and output secret-bearing values.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The string 38d2391985e2369a5fb8227d8e6cd5e5 is a 32-character hex value (high entropy) and is embedded directly in the docs as the secret component used to compute the request signature (X-Auth-Sign = MD5("100003 & timestamp & 38d2391985e2369a5fb8227d8e6cd5e5")). This is a directly usable credential/secret and should be flagged.

Items explicitly ignored: the "Bearer xxx" return value is a placeholder; X-Auth-Appid = 100003 is an identifier (not a secret); the local token endpoint and instructions are operational details, not secret values.