千易WMS测试

千易 Q-WMS 仓储管理技能（测试版）。帮助用户完成 Q-WMS 插件安装、账号授权和库存查询。

Security Scan

The skill's description matches a WMS helper, but its runtime instructions call an undeclared/unspecified tool (q_wms_flow) and the skill provides no install/source details, which is inconsistent and worth investigating before use.

Purpose & Capability

The skill claims to help install/authorize/query Q-WMS, which is coherent with its name and description. However, nothing in the metadata or install spec explains how it will perform those actions (no binaries, no dependencies, no declared tool).

Instruction Scope

SKILL.md instructs the agent to 'call q_wms_flow' for authorization and inventory scenarios, but q_wms_flow is not declared, provided, or explained. This creates an execution gap and potential hidden dependency—it's unclear whether calling that tool would invoke local code, an installed plugin, or an external service, and what data would be sent.

Install Mechanism

There is no install mechanism (instruction-only). That minimizes disk-write risk, but also means any required tooling must already exist in the agent environment; the SKILL.md does not document how to obtain the referenced tool.

Credentials

The skill does not request environment variables, credentials, or config paths. That is proportionate to the stated tasks—but absence of declared credentials increases the importance of knowing how q_wms_flow performs authorization.

Persistence & Privilege

always is false and the skill is user-invocable; there is no indication it requests permanent/autonomous elevated persistence beyond normal skill behavior.

What to consider before installing

This skill's purpose (Q-WMS install/authorize/inventory) is plausible, but SKILL.md depends on an unexplained tool named q_wms_flow. Before installing or enabling it: 1) ask the publisher for the tool's source, install instructions, and whether q_wms_flow runs locally or calls remote endpoints; 2) verify the skill's homepage or repository and confirm what network endpoints and data are involved in authorization flows; 3) do not paste credentials/keys into the chat until you confirm where they go; 4) if q_wms_flow is expected to be preinstalled in your agent environment, confirm with your admin what that tool does and what permissions it has. Because the source is unknown and the runtime dependency is unspecified, treat this skill as untrusted until those questions are answered.

千易 Q-WMS 技能（测试版）

安装

用户提到安装 Q-WMS 时，告知用户联系千易技术支持获取安装命令，或访问千易官网文档。

授权

用户说"授权"、"绑定"、"登录"时，调用 q_wms_flow 工具发起授权流程，返回授权链接。

库存查询

用户查询库存或仓库时，调用 q_wms_flow 工具，scenario=inventory，按返回结果引导用户完成查询。

语言

用户消息包含中文时，用简体中文回复。