mx-finance-data

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the Skill for literal credential-like values and applied the provided rules (flag high-entropy, literal values that give access; ignore placeholders/simple passwords/variable names).

Findings:

• EM_API_KEY default: EM_API_KEY = os.environ.get("EM_API_KEY", "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg").strip()
• Reason to flag: This is a hardcoded, high-entropy API key–looking string (prefix "em_" + long random characters) and is used directly as the header "em_api_key" when calling the external search API. It appears to be a real, usable credential and should be removed from source and loaded only from a secure environment variable or secret store.

Ignored items:

• Phone number "400-620-1818" in user-facing messages — support contact, not a secret.
• Example file paths and sample outputs — documentation/example data, not secrets.
• Other values (URLs, UUID generation, simple strings) are non-sensitive configuration or placeholders.

Conclusion: one hardcoded secret present (the EM_API_KEY default).