linkfox-shopee-store-sbs

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal, high-entropy values that could be used as credentials. Most candidate strings in the repo are clearly placeholders or examples (e.g., "", "xxx", example shopId "67890", environment variable names, URLs), so I ignored them per the policy.

The one literal that looks like a non-placeholder, high-entropy value is the base64-like UID string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py. The code comments indicate this is a "fixed uid header (实测可用)" used in the login chain and it is injected into request headers when no user_id is available. Because it is a literal token-like value that can be used in an authorization-related header, it meets the definition of a secret (a literal value that could provide access) and should be flagged.

All other occurrences (example API keys, env var names, short/simple strings and numeric examples) are documentation placeholders or low-entropy examples and were not flagged.