nano-banana-multi-reference-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly documents passing an API key with a --api-key CLI flag and discloses the key format (sk-api-*), which encourages embedding the secret verbatim into generated commands or outputs (an insecure exfiltration pattern).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-provided free text (the --prompt and optional --system strings) is sent as the messages[].content / prompt fields to the AI Hive API via cmd_chat/cmd_image → AiHiveClient.chat_text() / AiHiveClient.generate_image() without selecting any specific trusted item first.