linkpix-shein-image

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to ask the user for an API key and then pass it directly into a command-line argument (qhkit config set --token <密钥>), which exposes the secret value in the LLM's context and output history.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill executes npm i -g @iqinghu/qhkit and fetches Node.js binaries from nodejs.org to set up its required runtime CLI, but @iqinghu/qhkit is a common third-party unofficial package and nodejs.org is a standard distribution channel for an independent tool rather than an official publisher of this specific skill.