linkfox-1688-search-by-image

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the repository for literal high-entropy values that could act as usable credentials. The only candidate is the base64-like string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py (line 48-49). It is a non-placeholder, non-trivial encoded string (not a generic marker like YOUR_API_KEY) and is used as a fallback UID header for login flows ("登录链路固定 uid（实测可用）"), which indicates it can be used in requests. Therefore it qualifies as a hardcoded credential worth flagging.