dx

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged only one item. In evals/outcome-evals.json line 8 the transcript contains "[debug] loaded token shp_live_9f3kq2281mmx from ~/.shipctl" — this looks like a real, environment-specific API token (visible "live" prefix + random suffix), so it meets the definition of a secret (high-entropy, usable credential) and should be treated as sensitive.

I ignored other obvious-looking values:

• evals/fixtures/sdk-quickstart/README.md: "qp_test_123" — low-entropy, clearly a test/example key in quickstart docs, treated as a non-sensitive example per the rules.
• Any prefix examples in docs (e.g., sk_test_/sk_live_ style mentions) or environment variable names are documentation examples/placeholders and were not flagged.