base64-secret-padding-mismatch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill explicitly instructs copying/pasting full Base64 secrets and shows literal secret values embedded in CLI commands (e.g., railway variables set 'INTERNAL_API_SECRET=...='), requiring the agent to include secrets verbatim in output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The document contains a high-entropy Base64 value that appears to be a real secret rather than a placeholder or low-entropy example. The string "VbjsOyAxdAuOtBkiSXZiUX2sA4ELpO6FFx3Y8lIDiD4=" appears multiple times (Convex/Railway examples). It is random-looking, ends with = padding, matches the length expected from openssl rand -base64 32, and is used as an explicit environment value (not a named variable or "YOUR_API_KEY" placeholder). Per the provided rules, this should be treated as an actual usable credential. No other high-entropy secrets are present; other items are explanatory or examples of CLI output.