minimax-h3-dynamic-comic-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly documents passing an API key with --api-key (and shows the key format), which encourages embedding secret values verbatim on the command line or in generated commands/outputs, creating a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow scripts/videogen.py reads outsider-authored free text from the --prompt CLI argument (and optional --system) and sends it in the messages body to the AI Hive chat/text or generation/video endpoints without requiring selection of any specific pre-existing item.