hmos-local-test

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill documentation and scripts for literal high-entropy credentials. No API keys (e.g., sk-...), private key / PEM blocks, or obvious passwords were present. However, several image URLs embedded in the docs include HW-CC-Sign query parameters with long hex/signature values (e.g. HW-CC-Sign=BACF4BAC36E326094549FA11144E08A078B027F666EA13E76929A65A97101F7E and others). These are long, random-looking tokens used to sign CDN URLs and are high-entropy literal values (not placeholders). Even though they may be temporary/signed-URL tokens, they constitute embedded secrets (access signatures) in the documentation. Other content (file paths, command examples, option names like YOUR_API_KEY) are documentation placeholders or non-sensitive and were ignored.