website-launch

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill and reference files for literal, high-entropy credentials. Most values are placeholders (e.g. {siteId}, {firebaseProject}, REPLACE_WITH, ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}) or configuration examples and were ignored per the rules.

However, I found a literal high-entropy ACME TXT value in the Firebase REST API example: "Kl50WF6Xp532l4EmJ2TigjWE2b4u9Njl_-JtkiXmPig". This is a long, random-looking token used as the ACME challenge rdata in the example response. Per the secret definition (high-entropy literal that can be used to validate/operate on a resource), this qualifies as a secret-like value in the docs and should be treated as sensitive (even if it may be an example/point-in-time token).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill includes an explicit command to run Chromium with the --no-sandbox flag, which disables the browser sandbox and encourages bypassing a host security mechanism.