qinghu-image-ad-assets

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user to obtain an API key and configure it using a CLI command with the token passed as an argument (qhkit config set --token <密钥>), which exposes the credential.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow processes video URLs provided by the user to generate text content, but video content fetched from external links constitutes outsider-authored free text ingested at runtime.