linkpix-promo-poster

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask the user for an API token and pass it directly to a CLI command via a flag (--token <密钥>), which exposes the secret value in the command-line arguments and the agent's context/output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to download and execute Node.js from nodejs.org and install an external npm package (@iqinghu/qhkit) via an untrusted or non-verifiable channel at runtime, constituting a high-risk operational dependency.