security-vulnerability-scanner

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I reviewed the skill documentation for literal, high-entropy credentials.

Findings:

• sk_live_abcd1234efgh5678ijkl9999 — Present verbatim in the README example for hardcoded secrets. It matches the "sk_live_" prefix used by Stripe and is a long, random-looking string (not a clear placeholder like "sk-xxxx"). This appears to be a realistic API secret and should be treated as a secret.
• sk_live_a1b2c3d4e5f6g7h8i9j0 — Present in the remediation_suggester hardcoded_secrets example. Same rationale as above (Stripe-style prefix + random-looking characters) — treat as a secret.
• API_KEY = "sk_live_secret" — Present elsewhere; this is low-entropy and clearly a placeholder-like value ("secret") — ignore as a documentation placeholder.
• token = "ghp_myGitHubToken123456789" — Contains the GitHub PAT prefix "ghp_" but includes the readable substring "myGitHubToken" and trailing digits; lower entropy and used in an example. Treat this as an illustrative/example value (ignore).

I flagged the two sk_live_* strings because they are literal, non-obvious, high-entropy-looking values in code examples and match real API key patterns (not simple placeholders). Other demo values that are clearly placeholders or low-entropy examples were ignored.