linkpix-media-tools

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the agent to configure an API token by asking the user to obtain it and passing it directly as a command-line argument (qhkit config set --token <密钥>), which exposes secret handling in plain text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installation of the Node.js package @iqinghu/qhkit via npm and fetching binaries from nodejs.org, but the package publisher and domain provenance cannot be verified as an established official entity under the required strict standards, resulting in a high-risk operational dependency.