telnyx-video-java

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a real-looking refresh token value embedded verbatim in example code (e.g., .refreshToken("eyJhbGciOiJIUz...")), which instructs the agent to place secrets directly into generated output and is therefore insecure.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a full, high-entropy JSON Web Token (JWT) literal used as the refreshToken value in the "Refresh Client Token" example. This token is not a placeholder (it is not redacted or truncated and does not use a generic name like YOUR_API_KEY) and appears directly usable to access the service until its expiry. Per the provided secret definition and analysis protocol, this qualifies as an actual secret that should be flagged. Other values in the doc (UUIDs, example IDs, simple strings) are low-entropy/sample values and were ignored.