linkfox-etsy-product-query

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal, high-entropy values that could provide access.
• Flagged: scripts/onboarding.py:[48-50] contains a base64-style string assigned to _LOGIN_FIXED_UID (default value "eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9"). The code comment says this is a "fixed uid header (实测可用)" for the login flow and it is used as a uid header when no access token is present. This is a non-placeholder, encoded literal that the service accepts as an authentication header — i.e., a usable credential — so it meets the definition of a secret.
• Ignored items: environment variable names (LINKFOX_AGENT_API_KEY, LINKFOXAGENT_API_KEY, etc.), example placeholders like "" in references/api.md, API URLs, short/simple strings (UA, device ids), and other defaults (e.g., numeric device aid). These are not high-entropy secrets or are explicit placeholders per the rules.

Therefore I mark a real secret present.