miximodel

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The file .claude/skills/miximodel/.env (shown as --- .env --- in the skill content) contains a high-entropy token value:

MIXIMODEL_ADMIN_TOKEN=oat_MzY5.aC1KQnFMRHB6dUh3Z21PMjBXVWN3d0tHTERpaTNSY3I1RklPel9MSzk2MDI4OTIwMw

This is not a documentation placeholder (not something like YOUR_API_KEY or sk-xxxx) and appears random/long (high entropy). The repo’s docs describe this variable as the admin bearer token used for admin API routes, so the literal value in the .env is a real, usable credential and should be treated as a secret. The MIXIMODEL_API_URL is benign (a localhost URL) and not a secret, so it is ignored.