publish-seo-batch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds a site verification key ("f1e4781767e4472e9061ad0f853449d3") directly in the Python JSON payload and curl flow, which requires the agent to include that secret verbatim in generated output/requests.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I searched the document for literal, high-entropy values that could grant access. The 32-character hex string f1e4781767e4472e9061ad0f853449d3 appears verbatim in three places: as the verification filename in a public URL and as the "key" field in the IndexNow JSON payload. This is not a placeholder (it is a full random-looking value) and meets the entropy criteria for a secret/verification token, so I flag it as an actual credential. No other high-entropy secrets or private keys are present; other values are placeholders, filenames, or low-entropy examples and are ignored.