linkfox-aigc-textgen

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal, non-placeholder secrets. Most values are configuration, example URLs, env var names, or short placeholders (ignored per rules). However, scripts/onboarding.py contains a literal base64url string assigned to _LOGIN_FIXED_UID:
• It is a non-trivial base64url value (not an obvious placeholder like "") and the nearby comment says "登录链路固定 uid header（实测可用）" (fixed uid header, empirically usable), indicating it is a concrete header value used in the login flow when no user_id is present. Because it is a literal token-like value embedded in code and appears intended to be used in requests, it qualifies as a hardcoded credential worth flagging.

No other high-entropy API keys, private keys, or token-like literals were found. Many other references are environment variable names, example placeholders, or public URLs which I ignored per the guidelines.