linkpix-seedance-2-sales

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the user/agent to configure an API token via command line (qhkit config set --token <密钥>), but it instructs the user to provide the key and has the agent execute the command with the user's provided token. However, looking closely at line 66-69, it tells the agent to ask the user for the API key and then run the command with it, which exposes the secret value in the agent's context and generated execution commands (e.g., qhkit config set --token <密钥>). Let's evaluate if this is insecure credential handling: asking the user for an API key and embedding it directly into a shell command qhkit config set --token <密钥> passes the secret through the LLM output and context, which presents an exfiltration risk.