scientific-schematics

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes insecure examples that embed API keys verbatim (e.g., a --api-key CLI flag with "sk-or-v1-..." and a hardcoded api_key parameter in Python), which encourages placing secrets directly into commands/code rather than keeping them only in environment variables.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill makes runtime API calls to OpenRouter (base URL https://openrouter.ai/api/v1) to both generate images and obtain Gemini 3 Pro review critiques that are injected into the prompt-improvement loop, and the tool requires an OpenRouter API key—so external responses directly control prompts and are a required dependency.