environment-files

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The string "OPENAI_API_KEY=sk-proj-actualRealKey123456789" appears verbatim in the "Bad .env.example" section. It uses the genuine "sk-" prefix and contains a non-placeholder, non-descriptive token (alphanumeric sequence with numeric suffix) rather than an explicit placeholder like "sk-your-api-key-here". Per the rule "Only flag a secret if it is directly present and appears to be a real, usable credential," this is a hardcoded API key example and should be treated as an actual secret. (Other occurrences such as "sk-your-api-key-here" are documentation placeholders and were ignored.)