linkfox-shopee-store-auth

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal high-entropy values that could be usable credentials. Most candidates are environment-variable names (LINKFOX_AGENT_API_KEY / LINKFOXAGENT_API_KEY), placeholders, short example tokens (e.g., "abc123"), or numeric IDs (e.g., "67890") — all of which match the “ignore” rules (placeholders, low-entropy setup/example values).

The one literal that appears to be a non-placeholder, encoded header value is the base64-like string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py. The comment says "登录链路固定 uid header（实测可用）" (fixed uid header, tested usable), and the value is a compact base64url JSON blob rather than an env var name or example. This looks like a static, usable identifier/header that could be abused in the authentication/login path, so I flag it as a potential secret.

No RSA/PEM blocks, API keys (sk-...), or other long credentials were present.