linkfox-shopee-store-fbs

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for high-entropy literal values that could grant access. Most references to credentials are environment-variable names or placeholders (e.g., "", "$LINKFOXAGENT_API_KEY") which are documentation examples and were ignored per the rules.

One literal stands out: a base64url-looking string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py. It is a non-obvious, high-entropy value (not a placeholder), is used as a fallback uid header for login, and the surrounding comment notes it is "实测可用" (tested usable). Because it is a hardcoded token-like value that the code may send to remote services as an authentication header, I classify it as a hardcoded secret and flag it.

No other high-entropy, directly usable credentials (API keys, private keys, or complex passwords) were found.