emis

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged only high-entropy, literal credentials that appear directly in the files.
• references/auth-flows.md: The JSON includes a literal client_id (UUID) and a client_secret ("wBAiHA5N/...") — the client_secret is high-entropy/base64-like and the client_id is a real-looking UUID, so these are actionable credentials.
• references/financial-ops.md: The cURL examples contain a literal Bearer token ("9720bdc4-22cb-491f-af25-df584bec630a") used in Authorization headers — this is a literal access token.

Ignored items / not flagged:

• Placeholders like <client_id>, <client_secret>, <access_token> (documentation placeholders).
• Example/test card data (e.g., "4111111111111111", "123") and simple sample strings — low-entropy or obvious examples per the rules.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documents a payment gateway API (EMIS GPO) with explicit endpoints and workflows to perform financial transactions: authorizations, captures (payments), one-shot payments, refunds, and cancellations. It names OAuth token endpoints for server-to-server access and specifies required parameters (supervisorId/supervisorCard, merchantReferenceNumber), so it is specifically designed to move money rather than being a generic tool.