linkfox-amazon-reviews-list

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy values that could be usable credentials. Most values are configuration names, example ASINs, URLs, or environment-variable placeholders (e.g., LINKFOX_AGENT_API_KEY), which are not secrets per the rules.

However, scripts/onboarding.py contains a hardcoded base64url string assigned to _LOGIN_FIXED_UID:

• It is a literal, non-placeholder value (not an env var name) and is used as a fixed UID header for the login chain ("登录链路固定 uid header（实测可用）"), i.e., it is functioning data used in authentication headers. It appears to be an encoded token-like value (high-entropy), so I flag it as a potential secret.

No other high-entropy API keys, private keys, or credential-like literals were found. Environment variable names, example passwords, ASINs, UA strings, and URLs were ignored as non-secrets per the rules.