telnyx-voice-conferencing-ruby

Fail

Audited by Snyk on Mar 27, 2026

Risk Level: HIGH
Full Analysis

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

  • Secret detected (high risk: 1.00). I scanned for high-entropy literal values that could provide access. I found multiple occurrences of long, random-looking call_control_id-style strings that are embedded directly in examples, e.g.:
  • "v3:MdI91X4lWFEs7IgbBEOT9M4AigoY08M0WWZFISt1Yw2axZ_IiE4pqg"
  • "v3:550e8400-e29b-41d4-a716-446655440000_gRU1OGRkYQ"

These values are high entropy (random-looking, base64-like suffixes) and are used as call_control_id / connection identifiers in example API calls — the docs indicate call_control_id is "used to issue commands via Call Control API", so a literal token here could be usable. They do not match the listed documentation-placeholder patterns (e.g., "YOUR_API_KEY", "sk-xxxx") and are not simple example passwords or obvious placeholders.

I did not flag UUIDs like "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" or short example strings (e.g., "id", "queue_name", "1234#") because those are low-entropy, typical placeholders or standard UUID examples and fall into the "ignore" rules.

Issues (1)

W008
HIGH

Secret detected in skill content (API keys, tokens, passwords).

Audit Metadata
Risk Level
HIGH
Analyzed
Mar 27, 2026, 01:03 AM
Issues
1