linkfox-google-trend-get-trend-by-keys

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy credentials. Most occurrences are environment variable names (e.g., LINKFOX_AGENT_API_KEY / LINKFOXAGENT_API_KEY) or placeholders and therefore ignored per the rules.

I identified one literal, non-placeholder token: _LOGIN_FIXED_UID in scripts/onboarding.py. It is a base64/url-safe looking string (appears to decode to a JSON object) and is used as a fixed UID header fallback for the login flow. Because it is a hardcoded token (random-looking, not a named placeholder) that is injected into request headers, it qualifies as a potential active credential and should be treated as sensitive.