linkfox-echotik-seller-detail

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy credentials. Most candidate values are placeholders or benign (e.g., numeric sellerId examples, env-var names like LINKFOX_AGENT_API_KEY, curl examples showing $LINKFOX_AGENT_API_KEY) and are ignored per the rules.

I flagged the hardcoded base64-like string in scripts/onboarding.py: it is a non-placeholder, JWT-like value used as a fixed UID header fallback (_LOGIN_FIXED_UID). Because it is a literal, high-entropy token embedded in code and is used in the login/header flow (not labeled as example or placeholder), it meets the definition of an actual credential and should be treated as a secret.