linkpix-marketing-assets

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt instructs the agent to ask the user to obtain an API key and pass it via the command line using --token <密钥>, which exposes the secret value directly in the command output and context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to install and execute a Node.js package (@iqinghu/qhkit) from npm and download Node.js binaries from nodejs.org or npmmirror during runtime setup, which constitutes a common/reputable unofficial or third-party operational dependency depending on the context, but the primary npm package is hosted on npm (a standard registry) with official publisher alignment (iqinghu.com). However, because it fetches external binaries and packages at runtime, it falls under common unofficial/third-party operational dependency classification.