audit-skill

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all provided files for literal, high-entropy secret values that could grant access to services.

Confirmed secret:

• evaluations/test-scenarios.md:[234] contains a hardcoded Fernet-style key: b'ZmDfcTF7_60GrrY167zsiPd67pEvs0aGOv2oasOM1Pg='. This is a long, random-looking base64 string used as an encryption key in code (get_key()), which qualifies as a real secret (high entropy, provides access to encrypted data) and must be flagged.

Ignored items (not flagged) and why:

• sk-1234567890abcdef and other "sk-..." examples (evaluations/test-scenarios.md, SKILL.md, reference/security-audit-guide.md) — documentation/test placeholders; short or truncated and clearly illustrative.
• API keys like "demo-key-12345", "fallback-key" (examples/security-audit-example.md, examples/security-audit-example.md) — obvious demo/example values (low entropy).
• Simple passwords such as "password123", "secret", "admin123", "mysecretpassword", "password" (SKILL.md, reference/security-audit-guide.md, etc.) — low-entropy setup/examples; treated as documentation placeholders.
• Base64 string "YWRtaW46cGFzc3dvcmQ=" (SKILL.md) — decodes to "admin:password", low entropy / sample credential.
• Truncated/redacted tokens like "eyJ...your-key-here" or "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." (reference/security-audit-guide.md) — truncated/redacted, ignored per rules.
• Environment-variable references and names (many places) — not secrets.

Conclusion: only the hardcoded Fernet key (evaluations/test-scenarios.md:234) meets the criteria for a real secret.