AI商品广告大片 | TVC生成 | 电影级广告 | 品牌宣传片 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:12 AM UTC
• Version: 0.1.5

Overview

The skill fits its LinkPix video-generation purpose, but it needs Review because it installs mutable global tooling, stores a production token, and uploads user media with limited consent and cleanup guidance.

Install only if you are comfortable using LinkPix/qhkit as a third-party video service. Prefer an isolated or project-local, pinned CLI install; avoid automatic @latest upgrades; handle the API token through a secure secret mechanism rather than pasting it into commands; and confirm before uploading proprietary, unreleased, or personal media.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:6
• Finding: Unpinned npm Package Is Installed and Executed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6 and 43–66 **Vulnerability Type**: Unpinned and mutable third-party executable dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🎥","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to retrieve and execute the `@iqinghu/qhkit` npm package without pinning it to an audited version. It also explicitly instructs the Agent to install the latest available release and permits execution through `npx`. Consequently, the code executed during a future invocation is not necessarily the code that existed when the Skill was reviewed. An npm publisher-account compromise, malicious package update, registry compromise, dependency compromise, or unsafe mirror response could introduce arbitrary code. npm lifecycle scripts may execute during installation, while the installed CLI executes afterward as part of the Skill's normal workflow. Global installation is broader than necessary for the declared video-generation task. It changes the Agent user's shared environment and exposes other sessions to the installed executable. Automatically following upgrade instructions returned by the existing CLI further delegates control over local code installation to mutable external software. The separate Node.js bootstrap pipeline does not directly pipe downloaded shell code into a shell. It downloads an archive and checks it using a remotely supplied checksum before extraction. However, because the archive and checksum are obtained from the same origin or mirror, this verification detects corruption but does not fully protect against compromise of that distribution origin. ### Attack Path 1. An attacker compromises the npm publisher account ...[truncated 1302 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an implicit current version or `@latest`. 2. Record and verify the expected npm integrity digest or a publisher signature before installation. 3. Use a project-local, isolated installation directory instead of `npm -g`. 4. Run the CLI in a restricted container or sandbox with access only to the required input files and network endpoints. 5. Disable npm lifecycle scripts with `--ignore-scripts` when the package can operate without them. If scripts are required, audit them before execution. 6. Do not automatically execute upgrade commands returned by the CLI. Require explicit user approval and validate the target version against an approved list. 7. Pin transitive dependencies through a reviewed lockfile where deployment architecture permits it. 8. Avoid switching to a third-party registry mirror without equivalent integrity and provenance controls. 9. For the Node.js bootstrap, verify a signed checksum manifest or use an independently pinned digest rather than relying solely on a checksum downloaded from the same origin as the archive. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58
• Finding: API Token Is Passed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: Medium ### Vulnerable Code The source command, with its credential placeholder translated to English, is: ```bash qhkit config set --token <API_TOKEN> --env prod ``` ### Technical Analysis The Skill instructs the user or Agent to place a production API token directly in a command-line argument. After the placeholder is replaced, the plaintext token may become visible in shell history, Agent execution logs, terminal transcripts, diagnostic records, process-monitoring tools, or operating-system process listings. Although the Skill also mentions the `QHKIT_TOKEN` environment variable, it presents the command-line form as a standard configuration method and does not provide requirements for redaction, protected input, secure storage, or restrictive permissions. Environment variables also require careful handling because they can be exposed through logs or child processes, but they avoid placing the secret directly in shell history when injected securely by the execution environment. ### Attack Path 1. The user obtains a production token and provides it to the Agent. 2. The Agent substitutes the token into the documented `qhkit config set --token ...` command. 3. The command is recorded in shell history, an Agent transcript, process telemetry, or execution logs, or is observed through process inspection while running. 4. An unauthorized local user, log reader, support operator, or compromised monitoring component obtains the token. 5. The attacker reuses the token against the remote service to access the associated account or submit chargeable generation requests. ### Impact Assessment Exposure could permit unauthorized use of the associated video-generation account, including consumption of paid credits and access to any API capabilities granted to the token. The exact ...[truncated 282 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the command-line token option with a hidden interactive prompt that does not echo or log the credential. 2. Alternatively, read the token from a protected file descriptor or secret manager supplied by the execution environment. 3. If `QHKIT_TOKEN` is used, inject it without printing the assignment in transcripts and prevent it from being inherited by unrelated child processes. 4. Mark token-bearing values as secrets so Agent logs and telemetry automatically redact them. 5. Never include the token in shell history, command examples, error messages, or status output. 6. Store persistent credentials in an operating-system credential store or a file readable only by the owning user. 7. Document token revocation and rotation procedures for suspected exposure. 8. Use narrowly scoped, short-lived tokens when supported by the service. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill metadata uses broad activation language and a long keyword list for common advertising/video requests, which can cause the agent to invoke this external-service skill for loosely related prompts. That increases the chance of unintended tool use, unnecessary package installation, and external data transfer when a safer or more appropriate path would suffice.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger section gives positive examples of when to activate but does not define boundaries or counterexamples, so the agent may over-trigger on common ad/video tasks. In this skill, over-triggering is more dangerous because invocation can lead to installing software, requesting API tokens, and uploading user media to a third-party service.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill instructs users to set an API token but does not prominently warn against exposing secrets in shared logs, transcripts, or screenshots, nor does it emphasize using secure secret-handling mechanisms. This can lead to accidental credential disclosure, especially in agent-mediated sessions where command text may be echoed or stored.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill says local file paths and URLs can be passed directly and that the CLI will automatically upload them, but it does not clearly warn users that their media will be transmitted to an external service. In a media-generation skill, this is contextually important because users may supply proprietary product images, unreleased marketing assets, or personal media without realizing they leave the local environment.

Static analysis

No suspicious patterns detected.