linkfox-etsy-category-search

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I looked for high-entropy literal values that could be used to access services. The code contains one such hardcoded value: a base64-url-like string assigned as the default for LINKFOX_LOGIN_FIXED_UID in scripts/onboarding.py. The surrounding comment says this is a "fixed uid header (实测可用)" and the value is used as a UID header when no access_token is present, which indicates it can be used in the login/request header path. This is not a placeholder or an obvious example; it's a concrete, opaque token-like string and therefore meets the definition of a secret.

No other high-entropy API keys, private keys, or tokens are present. Environment variable names and placeholder examples (e.g., "") are ignored per the rules.