image-2-ecommerce-main-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly exposes a --api-key command-line option and references the sk-api-* secret format, which encourages passing API keys on the command line or embedding them verbatim in generated commands — a high-risk secret-exfiltration pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text from --prompt is sent at runtime to the AI Hive /openapi/v1/chat/text and /openapi/v1/generation/image endpoints via cmd_chat/cmd_image → client.chat_text(...)/client.generate_image(...), so the required workflow directly ingests untrusted prompt text.