qinghu-main-image-clone

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for a token and pass it directly as a command-line argument (qhkit config set --token <密钥>), which is an insecure credential handling pattern, though it also mentions supporting environment variables.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to download and execute Node.js binaries from nodejs.org and npmmirror.com during runtime setup if Node is missing, representing an unverifiable runtime external dependency from an unofficial/unverified source.