send-telegram
Fail
Audited by Snyk on Mar 6, 2026
Risk Level: HIGH
Full Analysis
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). I flagged the literal value "W6XV6RQORTB3eBDg" because it is presented as a "Telegram credential", is a single, high-entropy-looking string (mixed-case alphanumerics), and therefore appears to be a real, usable credential.
I ignored the following as non-secrets:
- workflowId
fkErsg4iulUvpcsa: an opaque workflow identifier (not an access secret). - chat ID
637313836: a numeric Telegram chat identifier (used to address messages, not an authentication credential). - webhook URL path and example code: endpoints and sample usage are not secrets here.
- other fields (names, labels, dates): documentation metadata, not credentials.
Action: treat "W6XV6RQORTB3eBDg" as sensitive (remove from public docs, rotate/revoke and store in a secrets manager).
Audit Metadata