linkfox-kalodata-tiktok-shop

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy credentials. Most values are examples, IDs, environment-variable names, or endpoints (which are allowed). However, scripts/onboarding.py contains a non-placeholder, base64-like literal assigned to _LOGIN_FIXED_UID ("eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9"). The code comments say this is a "fixed uid header (实测可用)" used in the login chain and it is used in request headers when no user_id is present. Because it is a literal token-like value (not a placeholder) that is directly used as an auth header fallback, it appears to be a real, usable credential and therefore should be flagged.

No other high-entropy API keys, private keys, or passwords were found. Numeric shop IDs and example JSON values (e.g., "7495514739648989419") are identifiers, not secrets, and environment-variable names are only referenced, not populated with secret literals.