linkpix-taobao-tmall-image

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to download and execute Node.js binaries and installation scripts from nodejs.org and npmmirror.com during runtime setup if dependencies are missing, constituting an operational runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill integrates with an AI image generation and e-commerce visual production service via the qhkit CLI tool (invoking actions like qhkit image generate and qhkit image estimate). It consumes service credits and interacts with a paid platform workflow. However, the documented payment operation (generating images and estimating costs) is entirely indirect/usage-metered (submitting generation tasks and checking estimated credit usage via API, but not executing direct financial settlements, direct transfers, charges, or purchases of money/funds by the agent). Therefore, as an indirect financial operation, it defaults to medium severity.