linkfox-aba-intelligent-query

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a hardcoded, high-entropy literal in scripts/onboarding.py. The string "eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9" is a base64-like token (not a simple placeholder) and is used as a fixed UID header for the login chain ("登录链路固定 uid header（实测可用）"). Because it is a literal high-entropy value embedded in code and used in authentication-related headers, it meets the definition of a secret that could provide access or affect authentication.

No other values in the repo qualify as secrets:

• Environment variable names (LINKFOX_AGENT_API_KEY, etc.), examples, and placeholders like "" are documentation placeholders and intentionally ignored per the rules.
• Short/simple strings and usage examples (e.g., sample passwords, UA, URLs) are low-entropy or clearly example values and were not flagged.