playwright-tests

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The playbook embeds real-looking secret/token values (HEYIRIS_TOKEN default, user_token, user_session_key) in code and examples, which would cause an LLM following the template to include those secret strings verbatim in generated test files or commands.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the file because it contains literal, non-placeholder credentials that look like real tokens:
• Line 139 contains a full-looking fallback auth token 'ca54cd87e7046098eee99de3b9c98cfd' (high-entropy hex string) used as a default TOKEN in examples — this is a literal credential and should be treated as a secret.
• Line 170 contains a concrete user_session_key 'e7ea9e64-ea8b-4c14-a6e3-687bf1888c40' (UUID). While UUIDs are sometimes used as opaque IDs, this one is used as a session key in localStorage and can provide access, so I flagged it as well.

Ignored items:

• Line 62 (HEYIRIS_TOKEN=ca54cd87...) is truncated with "..." and therefore treated as a redaction/truncation — per rules, truncated values are ignored.
• 'mock-token' in the API mocking code is an obvious mock/example and was ignored.
• Other simple values like admin@example.com, numeric IDs, and example strings are documentation placeholders and were ignored.