qinghu-1688-image-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for an API token and then pass it directly via a command-line argument (--token <密钥>), which exposes the secret value to the agent's context and command execution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents a paid MCP tool call (1688goods_image_search_global) that consumes credits/funds via the qhkit mcp call command. Since this service interaction involves paid API consumption/credits rather than a direct financial transfer, charge, trade, or purchase of external goods, it represents an indirect financial operation (submitting billable usage). Consequently, access control evaluation is not required for indirect operations.