alterlab-scientific-schematics

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that hard-code or pass API keys on the command line (e.g., --api-key "sk-or-v1-..." and api_key="your_openrouter_key"), which instructs embedding secret values verbatim in commands/code and creates an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill calls the OpenRouter API at runtime (https://openrouter.ai/api/v1) and relies on its responses—image data and Gemini 3.1 Pro Preview review text fetched from that endpoint—to drive prompt improvements and iterative regeneration, so remote content directly controls the agent's next prompts and is a required dependency.