byeapi-imagegen

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Several URLs point to loopback/private addresses (plain HTTP or non-public HTTPS) which are high-risk for delivering or redirecting to local resources and are commonly abused to hide malicious payloads; these should be treated as suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow passes the user’s free-text request directly into the ByeAPI clients as --prompt (and also concatenates batch --prompt values) without selecting any specific item first, so outsider-authored text is ingested at runtime.