aliyun-sms-bulk

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the provided skill prompt for high-entropy, literal values that could grant access.

Findings:

• The mcp configuration contains a baseUrl with an embedded path segment: https://openapi-mcp.cn-hangzhou.aliyuncs.com/accounts/31764980/custom/mcp_sms/id/a2iysyADk2BBO0Hd/mcp The segment "a2iysyADk2BBO0Hd" is a short, random-looking alphanumeric token. Because it is high-entropy and embedded in a service endpoint, it could be an access identifier or token that grants programmatic access if used by the MCP service. I treat this as a potential secret and flag it.

Ignored items:

• The numeric account id "31764980" looks like a non-secret account identifier (low entropy) and is not flagged.
• No other API keys, private keys, or high-entropy credentials were present. Other values are documentation, examples, or obvious placeholders and thus ignored per the rules.