astraflow-api

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal private key-like value in SKILL.md because it is a high-entropy, literal secret (hex string) embedded in an example and matches the definition of a credential that could be used to compute signatures. The accompanying PublicKey value on the previous line is present too but is not secret by itself; the PrivateKey is the sensitive item.

All other apparent values in the repository are clearly documentation placeholders or autogenerated example/placebo strings (e.g., values like "ZBipIhpf", "uminferapikey-xxxx", "org-xxxx", "", "" or short/simple words). Those are low-entropy examples or explicit placeholders per the docs and are therefore ignored as false positives.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). 本技能覆盖星图的管理类API，其中明确列出“StartPayUnpaidOrders — 批量支付欠费订单（写操作，谨慎调用）”。该接口用于发起支付/清偿欠费订单，属于直接的财务执行操作（move money / 发起支付）。因此技能具备显式的直接金融执行能力。