linkfox-aigc-videogen-multi

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for high-entropy, literal values that could function as real credentials. Most occurrences are environment variable names or placeholders (e.g., LINKFOX_AGENT_API_KEY, $LINKFOX_TOOL_GATEWAY) or example values and are ignored per the rules.

The file scripts/onboarding.py contains a literal, base64-url-like string assigned to _LOGIN_FIXED_UID that is not a placeholder and appears to be a fixed UID header used in the login flow ("实测可用" comment). It is high-entropy and could be used as an authentication-related header value, so it qualifies as a secret under the provided definition.