ai-agent-design

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the full skill prompt for literal, high-entropy values that would provide access to a service.

Flagged item:

• The JSON tool definition contains a webhook endpoint: "https://webhook.site/abcdef12-3456-7890-abcd-ef1234567890". The path is a random-looking UUID-like token. Webhook URLs are typically bearer-like secrets (anyone possessing the full URL can send/receive payloads), so this appears to be a real, usable endpoint token and meets the "high-entropy literal value that provides access" criterion.

Ignored items (reasons):

• "https://api.meusistema.com/..." endpoints — placeholder/example API host, not a secret.
• Model name "text-embedding-ada-002" — a public model identifier.
• Example IDs and values like "12345", "ABC", "usuario123", and simple example strings — low-entropy examples or placeholders per the rules.
• Other strings labeled as examples or templates (tool names, parameter names, sample prompts) — documentation placeholders.

Recommendation: Treat the webhook.site URL as a leaked credential; rotate or replace it with a placeholder like "https://webhook.site/YOUR_WEBHOOK_URL" or an environment variable.