android-example-voting

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill for literal credentials. I flagged the hardcoded ADMIN_SECRET because it is a literal byte-array included in the compiled app and is used as the admin witness value (it grants the ability to close polls). Even though it's a repeated byte pattern (0x42), it is an actual secret value embedded in code and therefore a credential leak.

I ignored obvious placeholders and examples:

• PASSKEY_RP_ID = "YOUR_DOMAIN.example.com" (documentation placeholder)
• assetlinks SHA-256 entry "SHA-256:..." (placeholder)
• other version strings, URLs, and example passwords are not secrets per the rules.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill integrates a blockchain wallet and explicit transaction APIs. It uses the Kuira / Midnight SDK wallet features (PanelBar wallet UI, WalletForegroundService) and constructs write-capable contract handles with the wallet's coin public key, then calls .deploy and .call to perform on-chain contract deployments and transactions. The docs also mention send/receive and dust registration. These are specific crypto/blockchain wallet and transaction operations (wallet keys, deploy/call, send), which constitute direct financial execution capabilities.