creating-coloring-books

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt explicitly embeds plain-text credentials (username="delorenj", password="Ittr5eesol") within Python code and lists them in prerequisites, which violates secure credential handling guidelines.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow navigates to Google Images via a browser and takes screenshots/thumbnails, which are converted to image assets and processed by image editing APIs without ingesting outsider-authored free text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a hardcoded password (Ittr5eesol) for a Piwigo media gallery (media.delo.sh) inside SKILL.md (lines 172 and 180). This is a literal credential providing access to a service rather than a placeholder, low-entropy setup password, or example value.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents an end-to-end coloring book creation and publishing pipeline (SKILL.md:4-9). While it discusses setting prices for digital and print items across multiple storefronts (SKILL.md:278-309) and navigating to storefront listing/creation pages in a browser (SKILL.md:316-377), these actions involve publishing listings, uploading digital files/ZIPs for sale, and configuring product descriptions rather than executing direct financial operations such as transfers, charges, or payment processing (which are handled externally by the respective platforms like Etsy, Gumroad, and Amazon KDP). Therefore, this represents an indirect workflow (creating products and listings for downstream sales handling) rather than a direct financial operation.