todolist-skill

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High-risk: the code hard-codes and uses a third-party cloud environment ID and initializes wx.cloud to that env, causing user identifiers and todo content to be sent to and stored in an external cloud (possible data exfiltration / supply-chain backdoor).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the code for literal, high-entropy values that could constitute active credentials.
• Found CLOUD_ENV_ID = 'cloud1-5g39elugeec5ba0f' (utils/util.js). This is a non-placeholder, random-looking environment identifier embedded as a literal and is used to initialize wx.cloud (wx.cloud.init({ env: CLOUD_ENV_ID, ... })). Because it is a specific, hardcoded environment identifier that can be used to target/initialize the cloud environment, it meets the criteria of a literal high-entropy value that may provide access to a service, so I flag it.
• Other constants such as PREVIEW_MODE_KEY, TODOS_STORAGE_KEY, and the fallback 'demo_user' are simple names/placeholders and not secrets, so they are ignored.

No API keys, private keys, or other high-entropy credentials were found.