image-studio

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I looked for high-entropy, literal credentials (strings that look like an API key or id:secret token). I found several hardcoded id:secret-shaped tokens embedded as string literals in the unit tests. They match the fal key pattern (UUID:hex) and therefore qualify as high-entropy secrets under the provided definition. Even though they are present in tests (likely test/sample values), they are literal tokens and should be treated as secrets (or replaced with clearly marked placeholders) — so I flag them rather than ignore them as placeholders.

I did not flag environment variable names, model IDs, or low-entropy example passwords because those are documentation placeholders or non-secret identifiers per the rules.