linkfox-fastmoss-product-rank-top-selling

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal, high-entropy values that could grant access. No API keys, PEM blocks, or obvious private keys are present in SKILL.md, references/api.md, references/onboarding.md, or scripts/fastmoss_product_rank_top_selling.py.

However, scripts/onboarding.py contains a long base64url string assigned to _LOGIN_FIXED_UID (lines 48-49). This is not an environment-variable name or an obvious placeholder — it is a concrete, random-looking value used as the fallback uid header for login ("登录链路固定 uid header（实测可用）"). Because it is a literal high-entropy token-like value used in an authentication header (and thus could be used to impersonate or influence auth flows), I treat it as a potential secret and flag it.

No other hardcoded secrets meeting the policy (API keys, private keys, or other complex credentials) were found. Plain example values, environment variable names, and public endpoints were ignored per the rules.