dubbing

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal, high-entropy credentials. I found a 32‑hex-character API key literal in lib/telemetry.mjs which is an actual Amplitude ingestion key:
• lib/telemetry.mjs:14 contains "d795c0c0328160be4d7df3365eb0c05e" — a high-entropy API key string. The file even comments that it is a "Write-only ingestion (project API) key." Even if it is intended to be public-by-design (only for sending events), it is still a real API key literal in the codebase and therefore should be flagged.

Other values (env var names like XP_API_KEY, default URLs such as https://api.perso.ai, placeholder text, and normal config constants) are not flagged because they are not secret literals (they are either names, endpoints, or clearly non-sensitive examples).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a billing tool that generates Stripe payment/checkout links and commands to buy plans or credits (e.g., node scripts/billing.mjs link --checkout ..., --credits --quantity <n>). This is a specific payment-gateway integration (Stripe) and therefore meets the "Direct Financial Execution" criterion.