playcanvas

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a literal, high-entropy Bearer token in the API examples. It is not a placeholder (e.g., YOUR_API_KEY) or truncated/redacted, and it appears to be a real access token string (random-looking alphanumeric). Per the secret definition, this qualifies as an actual credential that provides API access and should be flagged. No other strings in the docs meet the high-entropy secret criteria; common emails, placeholders like , and example/simple values were ignored.