generate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill tells the agent to ask the user for their API key and shows commands that embed the key verbatim (export KIE_API_KEY=... and velsgenerate config --set-key ...), which requires the LLM to handle/output secret values directly and risks exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs running "velsgenerate models --refresh" to fetch a live model registry from docs.kie.ai (and references kie.ai) at runtime, and that fetched registry/docUrl is relied on to determine required input fields and model selection, so external content directly controls prompts/instructions.