spring-boot

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains an explicit JWT secret value in the YAML config and corresponding code examples that reference it, which requires the model to handle and may reproduce a secret verbatim in outputs.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the full skill prompt for literal, usable credentials. The YAML under "JWT 配置" contains a concrete secret value:

security.session.jwt.secret: SecretKey012345678901234567890123456789

This string is directly used by the JwtTokenManager (signWith(Keys.hmacShaKeyFor(secret.getBytes()))) to sign/verify JWTs, so it is a usable credential (HMAC key) and should be treated as a hardcoded secret. It is not a generic placeholder like "YOUR_API_KEY" nor a trivial example password; even though the value contains a predictable digit pattern, it is a literal secret in configuration and therefore should be flagged and removed/rotated in real deployments.