nano-banana-livestream-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill README explicitly instructs users to supply an API key via a --api-key CLI argument (and shows the sk-api-* format), which encourages embedding secret values directly in commands or outputs and could cause the LLM to include secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is taken directly from the runtime CLI arguments --prompt (and optional --system) and sent as the prompt/messages[*].content fields in the HTTP request POST {base}/openapi/v1/generation/image via skill_generate() → cmd_image() → client.generate_image().