x-cdp-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds an actual Bearer token string verbatim and instructs extracting the ct0 CSRF cookie and placing it into request headers, which requires the agent to handle and output credential-like values directly (exfiltration risk).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Found a high-entropy Bearer token literal in the document. It appears twice: once in the description and once in the example code's Authorization header. Although the text calls it a "public token (secret ではない)", it is a full, usable bearer token string (high-entropy, not a placeholder like YOUR_API_KEY) and therefore matches the definition of a secret (a literal value that can provide access to the service). No other high-entropy secrets (private keys, ct0 cookie values, etc.) are present; ct0 is referenced but not hardcoded.