spring-boot

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds a literal JWT secret ("SecretKey012345678901234567890123456789") in config and example code, which would encourage the LLM to reproduce or embed that secret verbatim in generated outputs (insecure).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the full skill prompt for literal, usable credentials. The YAML under "JWT 配置" contains a concrete secret value:

security.session.jwt.secret: SecretKey012345678901234567890123456789

This string is directly used by the JwtTokenManager (signWith(Keys.hmacShaKeyFor(secret.getBytes()))) to sign/verify JWTs, so it is a usable credential (HMAC key) and should be treated as a hardcoded secret. It is not a generic placeholder like "YOUR_API_KEY" nor a trivial example password; even though the value contains a predictable digit pattern, it is a literal secret in configuration and therefore should be flagged and removed/rotated in real deployments.