experience-content-media-image-generate

The script has a high-impact credential-disclosure flaw: it sends a Salesforce access token to any caller-supplied HTTPS host. This may be intended to authenticate downloads from a trusted image service, but without destination allowlisting the token can be exfiltrated. Do not use with untrusted URLs; restrict permitted hosts and avoid sending the org token unless required by a trusted endpoint.