linkfox-sorftime-walmart-keyword-research

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal, high-entropy credentials. Most values are environment variable names, placeholders, or example strings (e.g., LINKFOX_AGENT_API_KEY, API endpoints, curl/json examples) which per the guidance are intentionally ignored.

I flagged one hardcoded base64-url-like UID string in scripts/onboarding.py:

• _LOGIN_FIXED_UID is assigned a literal value ("eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9"). The code comment says this is a fixed login UID header ("登录链路固定 uid header（实测可用）") and the value is used as the uid header when no access_token is present. That makes it a directly present, reusable credential-like header (high-entropy literal that can be used in requests), so it meets the definition of a secret to flag.

Ignored items and why:

• Environment variable names (LINKFOX_AGENT_API_KEY, LINKFOXAGENT_API_KEY, etc.) — documentation placeholders, no literal values present.
• Example API usage and example JSON objects — obvious samples/placeholders.
• Other static strings (User-Agent, URLs) — not credentials.