lightwan-cli

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal SERIAL and TOKEN hex strings because they are high-entropy, concrete values likely to be usable credentials (they appear as exact assignments found in setting.conf). These are not placeholders (they are full hex strings, not "YOUR_API_KEY" style tokens).

Ignored items / not flagged:

• USERNAME=15211166832 and CUSTOMERID=212920001 are low-entropy identifiers (phone number / numeric ID) and are not treated as secrets per the rules.
• No RSA/PEM private keys or other sensitive blocks were present.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs running commands that start/stop a root-owned daemon and create/remove a tun interface (modifying network state and processes), which changes the machine's system state and can require elevated privileges.