telnyx-voice-conferencing-ruby
Audited by Snyk on Mar 27, 2026
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). I scanned for high-entropy literal values that could provide access. I found multiple occurrences of long, random-looking call_control_id-style strings that are embedded directly in examples, e.g.:
- "v3:MdI91X4lWFEs7IgbBEOT9M4AigoY08M0WWZFISt1Yw2axZ_IiE4pqg"
- "v3:550e8400-e29b-41d4-a716-446655440000_gRU1OGRkYQ"
These values are high entropy (random-looking, base64-like suffixes) and are used as call_control_id / connection identifiers in example API calls — the docs indicate call_control_id is "used to issue commands via Call Control API", so a literal token here could be usable. They do not match the listed documentation-placeholder patterns (e.g., "YOUR_API_KEY", "sk-xxxx") and are not simple example passwords or obvious placeholders.
I did not flag UUIDs like "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" or short example strings (e.g., "id", "queue_name", "1234#") because those are low-entropy, typical placeholders or standard UUID examples and fall into the "ignore" rules.
Issues (1)
Secret detected in skill content (API keys, tokens, passwords).