akshare-a-shares

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I searched the provided skill files for literal high-entropy values that look like real credentials. I found two 32-hex-character strings used as appId values in akshare/air/air_zhenqi.py. They are embedded directly in API payloads (used to call the remote service) and look like real service identifiers/keys rather than placeholders or examples, so they meet the definition of a secret.

Matches:

• akshare/air/air_zhenqi.py — in air_quality_watch_point payload:
• "appId": "a01901d3caba1f362d69474674ce477f" This is a high-entropy literal included in the HTTP request payload.
• akshare/air/air_zhenqi.py — in air_quality_hist:
• app_id = "4f0e3a273d547ce6b7147bfa7ceb4b6e" This is another high-entropy literal used as an appId in request construction.

Notes on things not flagged:

• The code computes a "secret" value at runtime (via JS/MD5 calls) but does not embed that secret directly — that runtime-computed value is not a literal in the repository, so it is not separately flagged here.
• No obvious placeholders, low-entropy setup passwords, or redaction markers were present that needed to be ignored.