linkfox-amazon-policy-feed

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy values that could grant access.
• Flagged: scripts/onboarding.py lines 48-49 define a default _LOGIN_FIXED_UID with a base64url string ("eyJhX2lkIjoi..."). It is used as the fixed "uid" header when no access_token/user_id is present and is described as "登录链路固定 uid header（实测可用）" — i.e., a baked-in header value that the code uses for login flows. Because it is a literal credential-like token (base64-encoded JSON identifier) that the code will send to remote endpoints, it can function as an access artifact and therefore meets the secret definition.
• Ignored items: environment variable names (e.g., LINKFOX_AGENT_API_KEY), example/truncated IDs (e.g., "a1b2c3..."), curl placeholders, and other obvious examples are documentation placeholders or low-entropy examples and were not flagged per the rules.