fashion

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill document for literal high-entropy values that look like real credentials (API keys, bearer tokens, private keys, long random-looking passwords).

Findings:

• One high-entropy string appears in mobile-project-prompt.md inside the example Python request headers:
• "apikey": "sb_publishable_uyxE__Tjagj8Zb4oXDVgHw_VE7rt2_J"
• "Authorization": "Bearer sb_publishable_uyxE__Tjagj8Zb4oXDVgHw_VE7rt2_J"

Why this is flagged:

• The value is long, random-looking, and used in an Authorization / apikey header — it matches the pattern of a Supabase publishable key (sb_publishable_...). Per your secret definition, this is an actual API key literal present in the doc and therefore should be flagged.
• Note: publishable Supabase keys are often intended to be public (client-side) and limited in scope, but they are still literal credentials included in the repo. Given the rule to include actual API keys, I treat this as a secret disclosure to call out.

Other content:

• I found no RSA/PEM private keys, no other long bearer tokens, and no other high-entropy strings that look like real API keys.
• Many values in the doc are placeholders, examples, simple passwords, or configuration names (e.g., FASHION_DATA_DIR, YOUR_API_KEY, sk-xxxx style placeholders, example URLs). Per your ignore rules, these are not flagged.

If you want, I can:

• Suggest exact redaction text (e.g., replace the key with "REDACTED_SB_PUBLISHABLE_KEY") and a short remediation note about rotating any exposed key.