grok-imagine

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill explicitly asks the user to paste their Pixazo API key into the conversation and instructs the agent to save and use it in API requests (and to read it from conversation if present), which requires the LLM to receive and handle a secret and could lead to it being embedded in outputs or transmitted, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime path includes fetching external reference content from https://www.pixazo.ai/models/grok-imagine.md (and possibly the HTML variant) and then using that fetched text to determine request/polling schemas, which can introduce outsider-authored free text into the agent’s LLM context.