pw-image-generation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill contains scripts referencing an external third-party API router (ai-router.plugins-world.cn) which provides runtime model endpoints and configuration, constituting an unofficial operational dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The scan correctly identified an active, high-entropy API key (sk-1p6RyJLH3e3TnfMEfN9clcwZru2V513pAIwK8h5fMVUTDnEv) hardcoded within the config/secrets.md configuration file. This is a real credential and not a placeholder (unlike the template version found in config.example/secrets.md).