image-edit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs users to "use --api-key" and describes the API key format (sk-api-*), which encourages embedding secret values directly in command lines or outputs — an insecure pattern that can lead to secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via the user-supplied --prompt (and optional --system) in scripts/imagegen.py and sends it as messages/prompt to chat/text/generation/image.