llmquant-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly tells the agent to ask the user to paste a Remote MCP URL or API key and then add/update config entries (i.e., embed the secret into configuration), which requires the agent to accept and handle secret values even though it says "Never echo secrets," creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs the agent at runtime to fetch and follow the remote setup document at https://raw.githubusercontent.com/LLMQuant/llmquant-hermes/master/SETUP.md, meaning fetched content will directly control agent instructions.