consulting-an-oracle

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The pre-filter hit a GitHub-style token (ghp_...); I inspected the skill content and found the exact high-entropy string in test-pressure-3.md inside a committed .env.development example:

GITHUB_API_TOKEN=ghp_aB12cD34eF56gH78iJ90kL12mN34oP56qR78

This matches the GitHub Personal Access Token format (prefix ghp_ + long random-looking characters) and is a literal, high-entropy credential that would be usable if valid — so it should be treated as a secret.

I am ignoring the other values in that .env snippet (REDIS_PASSWORD=hunter2dev, DATABASE_URL user:appdev, etc.) because they are low-entropy/dev-style passwords and explicitly fall under "setup/dev passwords" to be ignored per the rules. This token is not a documentation placeholder (e.g., YOUR_API_KEY or sk-xxxx) and is not truncated/redacted, so it qualifies as a real secret.