linkfox-sorftime-walmart-product-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime path scripts/sorftime_walmart_product_analysis.py -> call_api(params) posts user-supplied JSON (including outsider-authored natural-language name) to /sorftime/walmart/productAnalysis via the Walmart ProductAnalysis operation router.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the repository for literal, high-entropy values that could be used for access.
• I flagged the base64url string in scripts/onboarding.py (lines [47]-[50]). It is assigned to _LOGIN_FIXED_UID and documented as a "登录链路固定 uid header（实测可用）" (fixed uid header, tested usable). This is a non-placeholder, encoded token-like value (high-entropy) embedded in code and used in request headers when no user_id is present, which makes it a usable credential/identity header rather than an innocuous example. Therefore it meets the definition of a secret.
• I did not flag environment variable names, default URLs, example API usage, simple example product IDs, or short/passphrase-like strings because those are documentation placeholders or low-entropy setup/example values (per the provided ignore rules).