nano-banana-pro-image-to-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly encourages supplying an API key via the --api-key CLI flag and references the "sk-api-*" format, which promotes embedding secrets in commands or outputs and could cause the LLM to include secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text via the --prompt (and optional --system) CLI arguments and forwards them as messages[].content / prompt to the AI Hive /chat/text or /generation/image endpoints without filtering.