linkpix-gpt-image-2

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the agent to ask the user for an API token and pass it via the command-line argument --token <密钥> to the qhkit config set command, which is an insecure credential handling pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs downloading and executing Node.js binaries directly from nodejs.org (with npmmirror.com as an alternative), which constitutes a weak/unknown runtime external dependency via direct script execution.