linkfox-echotik-list-seller

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal high-entropy credentials. Most values are documentation placeholders (env var names like LINKFOX_AGENT_API_KEY, example curl headers, "your-key-here") or configuration URLs and user-agent strings which are not secrets.

One literal high-entropy value appears in scripts/onboarding.py:

• _LOGIN_FIXED_UID = "eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9"

This is a base64-like token used as a fallback UID header for login ("登录链路固定 uid header（实测可用）"). That makes it a hardcoded, non-placeholder token that could be used in request headers and therefore potentially provides access/behavior in auth flows. It is not an obvious placeholder (not named YOUR_..., not documented as an example) and is fairly high-entropy, so I flagged it.

No other API keys, private keys, or high-entropy secrets were found. Example keys and environment-variable placeholders (LINKFOX_AGENT_API_KEY, LINKFOXAGENT_API_KEY, $LINKFOX_TOOL_GATEWAY, etc.) are intentionally documented and ignored per the rules.