image-2-image-edit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly suggests passing API keys via a --api-key CLI flag and shows the sk-api-* format, which encourages embedding secrets verbatim in commands/outputs (an exfiltration risk); alternatives like env vars are mentioned but the CLI-flag pattern is insecure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-provided free text via the --prompt CLI argument and forwards it in the JSON body to the provider endpoint POST /openapi/v1/generation/image (AiHiveClient.generate_image → scripts/imagegen.py cmd_image).