space-logo-generator

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Insecure: the prompt shows and requires embedding an API key as a command-line argument/configuration (--api-key "REMOVED_GEMINI_KEY"), which instructs the agent to include secret values verbatim in generated commands or scripts, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). 模式 B 的“分析用户上传的图片”会把用户提供的参考图片内容（外部用户/非操作员的输入）用于生成与提示词形成，从而以可读文本/上下文形式进入代理的 LLM 流程；该图片来源属于 OUTSIDER-AUTHORED 免费/任意内容。