creating-coloring-books

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt contains hardcoded plaintext credentials (username and password) in the instructions and Python code snippets for Piwigo authentication, which violates secure credential handling practices.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow browses Google Images and takes screenshots, which ingest untrusted web content/images and their surrounding text into the agent's environment.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a username (delorenj) and password (Ittr5eesol) for a Piwigo media gallery instance (media.delo.sh). The password string Ittr5eesol is a literal credential providing access to an external service.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides instructions for publishing and pricing digital coloring book products on storefronts like Etsy and Gumroad (Phase 8-9), which constitutes indirect financial operations (creating bills/listings for downstream sale). It also includes an API client interaction with fal.ai (service costs) and file uploads to a self-hosted Piwigo gallery (storage). No direct fund transfers, charges, or direct payment operations are performed.