linkpix-minimax-h3-sales

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the agent to ask the user for an API key/token and then execute a command using it as a direct command-line argument (qhkit config set --token <密钥> --env prod). This exposes the secret value in the command context and generated output.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides a CLI tool (qhkit) to generate e-commerce promotional videos via the Qinghu AI API (e.g., MiniMax H3). Generating videos via API calls consumes credits and initiates paid tasks (qhkit video generate), which constitutes a direct financial operation (purchasing/generating paid AI assets). The skill relies on API keys set via qhkit config set --token <key> or environment variables for authentication, which establishes independent service authentication/access control.