seo

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, high-entropy secrets that would grant access to services.

Findings:

• scripts/umami-report.ts includes a default SHARE_ID value: "GRVFnQSQSLlfRjCa". This is a random-looking, high-entropy 16-character string used to call Umami's public share API (/api/share/{SHARE_ID}) and is likely a usable share identifier/token. Because it can be used to obtain the websiteId and token (via the getShareAuth call) and thus access Umami analytics data, it qualifies as a hardcoded credential and should be treated as a secret.

Ignored items (false positives) and why:

• "G-XXXXXXXX" in the GA4 example: ignored because it is an obvious placeholder/example, not a real key.
• Environment variable names and defaults (e.g., UMAMI_BASE default URL "https://umami.lsd.sk", PROD_URL, etc.): these are configuration values or hostnames, not secrets.
• Other strings in the repo (IDs, URLs, YAML examples, example passwords or short words) are documentation placeholders or non-sensitive values and were ignored per the rules.

Recommendation: Remove the hardcoded SHARE_ID from source and require it to be supplied via environment variable (process.env.UMAMI_SHARE_ID) or otherwise redact it before publishing.