linkfox-shopee-store-media-space

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy values that could act as usable credentials. Most occurrences are placeholders like "" or environment-variable names (ignored per rules). The only literal that looks like a non-placeholder, high-entropy token is the base64-like string hardcoded as a fallback UID header in scripts/onboarding.py:
• _LOGIN_FIXED_UID = "...eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9..."

This is a concrete base64-url string (not a generic placeholder) used as a fixed UID header for login flows ("登录链路固定 uid header（实测可用）"). Because it is a specific, encoded value (high-entropy-looking) used in authentication-related headers, it may be an actual credential-like artifact and should be treated as a secret.

Ignored items: examples like export LINKFOXAGENT_API_KEY="", "xxx", shopId "67890", and other illustrative values are documentation/placeholders and not flagged.