Setup globally executes unpinned software and auto-accepts a remote Skill
Source references: 5The instructions globally install an unpinned npm CLI and use `npx ... -g -y` to add a Skill from a URL. No package integrity, fixed version, or publisher verification is given. The user is then told to trust any raw authorization URL printed by that CLI.
If the npm package, remote Skill, domain, or update channel is compromised, installation code could run with the user's permissions. A substituted authorization link could also cause mailbox access to be granted to an unintended service, affecting email, credentials, and local files. The evidence does not establish that compromise has occurred.
The setup globally installs an unpinned npm package and adds a Skill from a URL using `-g -y`; no version or integrity verification is shown. During OAuth, the installed CLI determines the raw authorization URL presented to the user. If the package or distribution endpoint changes, this could affect the machine, credential authorization, and account access; users can require pinned, verified artifacts.
**第 1 步 - 安装/更新 CLI**```bashnpm install -g @tencent-qqmail/agently-cli```**第 2 步 - 安装/更新 skill**```bashnpx skills add https://agent.qq.com --skill -g -y```Show 4 other places
**第 3 步 - OAuth授权** **交互式长命令**：必须后台运行命令（background+pty），从 stdout/stderr 提取它输出的原始授权 URL 并发送给用户。**必须包含文案提示**：`请点击或复制以下链接在浏览器中完成授权：`。用户在浏览器中完成授权后，命令会自动退出。**URL 输出规则**：将 URL 视为不可修改的 opaque string，不要做任何修改（包括 URL 编码/解码、添加空格或标点、重新拼接 query），用只包含原始 URL 的代码块单独展示给用户。```bashagently-cli auth login``````bashnpm install -g @tencent-qqmail/agently-cli``````bashnpx skills add https://agent.qq.com --skill -g -y``` **交互式长命令**：必须后台运行命令（background+pty），从 stdout/stderr 提取它输出的原始授权 URL 并发送给用户。**必须包含文案提示**：`请点击或复制以下链接在浏览器中完成授权：`。用户在浏览器中完成授权后，命令会自动退出。