Do not include API Keys, private prompts, generated private images, or other credentials in a public report.

For a suspected vulnerability, open a GitHub security advisory for blackdm666/dsh-plugin-88api-image when available. If advisory reporting is unavailable, open a minimal issue that contains no exploit details or secrets and ask the maintainer for a private contact channel.

Please include the plugin version or commit, DSH version, operating system, reproduction boundary, and whether any paid request reached 88api.ai.

DSH plugins execute as trusted local Host code. Installing this package is not equivalent to granting a sandboxed browser-extension permission.

The image_key_88api convenience tool can save a Key supplied through chat, but the original user message and tool-call arguments may remain in DSH history. Hidden terminal input through 88api-image set-key is the recommended method for sensitive or long-lived Keys.