linkfox-kalodata-tiktok-creator

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for high-entropy literal values that could be usable credentials. I found one base64-like string hardcoded as a default UID header in scripts/onboarding.py:
• _LOGIN_FIXED_UID = "eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9" (scripts/onboarding.py:48-49)

This is a non-placeholder, high-entropy base64-url string used as a fixed uid header for the login chain ("登录链路固定 uid header（实测可用）") and is applied to headers when no user_id is present. Because it is a literal credential-like token embedded in code (not an innocuous example or environment variable name), I treat it as a secret.

I found no other high-entropy API keys, private keys, or passwords. Numeric IDs (creatorId) and environment variable names (e.g., LINKFOX_AGENT_API_KEY) are documentation/placeholders and were not flagged.