seedream-5-lite-background-replace

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly documents using an --api-key flag (and shows the API key format), which encourages passing API keys on the command line or embedding them in generated commands — requiring the agent to handle secret values verbatim and risking exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text via the user-provided --prompt argument and sends it as messages[].content / prompt in client.chat_text() and client.generate_image() (no prior selection or filtering of specific items).