morpheus-fashion-design

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The script embeds a hard-coded Gemini API key and unconditionally includes a GEMINI_API_KEY (from env or the hardcoded fallback) in the payload sent to the remote ComfyDeploy run endpoint, which constitutes potential secret exfiltration; no obvious hidden eval/remote shell or obfuscated backdoor code was found.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The file contains a hardcoded, high-entropy Google API key string: "AIzaSyBCa0WCDlc6XYU6ZlwbqLB5D0hyeIuGmqA". It appears as the default fallback for GEMINI_API_KEY in scripts/generate.py:

GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY", "AIzaSyBCa0WCDlc6XYU6ZlwbqLB5D0hyeIuGmqA")

This is a literal API key (matches Google key pattern, high entropy) and therefore qualifies as a secret under the provided definition. Other values (DEPLOYMENT_ID, API endpoints, and simple/default strings) are not secrets and are ignored.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)