mx-stocks-screener

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill content for literal, high-entropy credentials. I found a hardcoded API key-like default in scripts/get_data.py:
• EM_API_KEY = os.environ.get("EM_API_KEY", "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg").strip()

This default value ("em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg") appears random/high-entropy and is an actual literal value that would be sent as the "em_api_key" header to the MCP endpoint — it meets the definition of a secret and should be treated as such.

No other high-entropy secrets (private key blocks, bearer tokens, etc.) were found. Items ignored: the MCP_URL (public URL), the phone number in an error message, and any simple/example strings — none of those are secrets per your rules.

Recommended remediation (brief): remove the hardcoded default, require EM_API_KEY to be provided via environment or secure secret store, and rotate the exposed key if it is real.