mx-macro-data

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the skill code and documentation for hardcoded credentials. I found a default API key set in scripts/get_data.py:
• EM_API_KEY is read from the environment but has a hardcoded fallback value: "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg"

This value is a high-entropy, random-looking string (not a placeholder like YOUR_API_KEY) and is used directly in request headers ("em_api_key"), so it qualifies as a literal secret (an API key) present in the repo.

Other items in the doc (e.g., DEFAULT_URL, DEFAULT_PAHT, the phone number 400-620-1818, environment variable name MX_MACRO_DATA_OUTPUT_DIR) are not secrets by the given definitions: they are configuration values, contact info, or env-var names and do not meet the high-entropy usable-credential criteria.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)