hsf

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, high-entropy credentials and ignored placeholders, config keys, paths, and low-entropy example passwords per the rules.

Flagged item:

• The example in assets/references/examples.md ("Micro Tier -- Webhook Signature Validator") contains a literal signing secret: whsec_K8e2pQ9xVn3bRtYm. This is a high-entropy token (it follows common webhook-secret key patterns like Stripe's whsec_ prefix) and is an actual secret value embedded in the doc, so it meets the definition of a secret.

Ignored items (not flagged) and why:

• ${CLAUDE_PLUGIN_ROOT}/... paths and other environment variable names (e.g., WEBHOOK_SECRET) are placeholders or configuration references — not secrets.
• JSON config values (numbers, currencies, file paths, queue names) are non-sensitive configuration literals.
• Inline examples, sample thresholds, and simple textual strings are low-entropy examples or documentation content and do not qualify as secrets.
• No private key / PEM blocks or other API keys (sk-..., pk-...) were present.

No redaction markers of the form REDACTED_SECRET_ were present.

Conclusion: one real secret literal was found (the whsec_ token) and should be treated as sensitive and removed or rotated.