java-framework-audit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly includes a hardcoded Shiro AES key and the checklist requires collecting configuration evidence (e.g., cipher keys/credentials) as EVIDENCE, which implies reading and reporting secret values verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the full prompt for literal, high-entropy values. I found the Shiro hardcoded AES key "kPH+bIxk5D2deZiIxcaaaA==", which is a real, base64-encoded AES key historically embedded in Shiro RememberMe functionality. This matches the definition of a secret (high-entropy, directly usable credential) and should be flagged.

No other high-entropy secrets, private keys, or API keys are present. Other strings are configuration names, CVE identifiers, or low-entropy example/placeholders (ignored per the rules).