feishu-cli-work

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged literal high-entropy values that look like real upload/file tokens (these can grant access to uploaded artifacts). Specifically, the JSON example in references/.../form-control-values.md contains:
• "D93653C3-2609-4EE0-8041-61DC1D84F0B5" — a GUID-like file_code (high-entropy).
• "TLLKdcpDro9ijQxA33ycNMabcef" — an alphanumeric file token (high-entropy).

These are not generic placeholders (like YOUR_API_KEY, ou_xxx, img_v3_xxx) nor truncated/redacted examples with "..." — they are concrete literal values that could be usable credentials or resource tokens, so I treat them as secrets.

Ignored items and why:

• img_v3_xxx, ou_xxx, omm_xxx, 7AB12C.../8XY99Z... (with "..."), and other "xxx"/truncated examples are documentation placeholders or redactions — low entropy or explicitly truncated — so they are not flagged.