亚马逊 商品图、主图套图、详情图、活动图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:13 AM UTC
• Version: 0.1.1

Overview

This image-generation skill matches its stated purpose, but it asks the agent to install and upgrade executable tools in unsafe, under-scoped ways and to receive an API key through chat.

Review before installing. Use this only in a contained environment, configure the Qinghu token outside the chat when possible, avoid giving it access to unrelated local files, and do not let the agent execute upgrade commands copied from CLI output without manually verifying the exact command and package version.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54
• Finding: Mutable Third-Party Packages Are Installed and Executed Without Version Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 54–57; related installation paths also appear at lines 80–83 and 93 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The accompanying instructions allow a fallback to: ```bash npx @iqinghu/qhkit <command> ... ``` Other mutable dependency installation or execution paths include: ```bash npm i -g @iqinghu/qhkit@latest pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i original-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to globally install an unpinned npm package. It also permits packages to be fetched and immediately executed through `npx`, including use of `--yes`, which suppresses an interactive confirmation. The upgrade workflow explicitly selects the mutable `latest` release. These practices make the code ultimately executed by the Skill dependent on package-registry state at invocation time rather than on a reviewed and reproducible dependency set. Package installation can execute package lifecycle scripts, while the installed CLI can execute arbitrary code with the permissions of the Agent process. The fallback mirrors add further trusted infrastructure. The audit found no evidence that the named packages or mirrors are currently malicious; the vulnerability is the unsafe, mutable supply-chain execution model. Global installation also exceeds the minimum privileges necessary for this image-generation workflow. A pinned, project-local or isolated installation would be sufficient. ### Attack Path 1. An attacker compromises a package maintainer account, package release process, registry, mirror, or transitive dependency. 2. The attacker publishes a malicious release under the expected package name or modifies a dependency selected by an unpinned installation. ...[truncated 918 chars]
• Remediation: ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version rather than using an implicit current version or `@latest`. 2. Record dependency integrity values in a lockfile and verify them before installation. 3. Install dependencies locally in a dedicated project directory or disposable sandbox instead of globally. 4. Avoid dynamically fetching and executing packages through `npx`. Preinstall and invoke a reviewed, pinned binary. 5. Disable package lifecycle scripts where compatible, for example through npm's `--ignore-scripts` option, and separately review any required installation scripts. 6. Use one explicitly approved registry. If mirrors are necessary, document their trust model and require equivalent integrity verification. 7. Run image processing and CLI operations in a restricted environment with access only to the required input and output files. 8. Require explicit user approval before installing or upgrading executable dependencies.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: API Token Is Requested Through the Conversation Channel## Vulnerability Details **File Location**: `SKILL.md`, lines 69–74 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code The instructions direct the user to generate an API key and send it to the Agent, after which the Agent runs: ```bash qhkit config set --token <API-key> --env prod ``` They also identify an environment-variable alternative: ```bash QHKIT_TOKEN ``` ### Technical Analysis Requesting that a user place an API secret in the conversation exposes the secret to every system that stores or processes the transcript. Depending on the surrounding platform, this can include conversation history, diagnostic logs, telemetry, model context, plugins, and administrative interfaces. Although the CLI requires authentication for its declared service, transmitting the token through chat is not necessary. The user can configure the token directly through a local secret store, protected environment variable, or terminal prompt without disclosing it to the Agent's conversational context. The Skill does not specify transcript redaction, output masking, file permissions for persisted CLI configuration, token lifetime, or revocation procedures. ### Attack Path 1. The user follows the Skill instructions and sends the Qinghu API token in a chat message. 2. The token is retained in conversation history, logs, telemetry, or Agent context. 3. A person, integration, or compromised component with access to that data obtains the token. 4. The token is used to authenticate to the Qinghu service. 5. The attacker submits API requests, consumes account credits, or accesses any resources authorized to that token. ### Impact Assessment The direct impact is compromise of the privileges assigned to the exposed API token. This may include unauthorized image-generation requests, credit consumption, and access to service-side resources available to the token. The findi ...[truncated 173 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction asking users to send API keys through the conversation. 2. Direct users to configure `QHKIT_TOKEN` themselves through the platform's approved secret-management interface or a local terminal outside the transcript. 3. Prefer a non-echoing interactive credential prompt or operating-system credential store. 4. Ensure persisted configuration files are readable only by the owning user. 5. Prohibit printing, repeating, or embedding the token in command output and error messages. 6. Redact recognized token formats from logs and diagnostic data. 7. Recommend short-lived, least-privilege tokens where the service supports them. 8. Document token revocation and rotation procedures for accidental disclosure.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:76
• Finding: Agent Is Directed to Execute Upgrade Instructions Obtained from Dynamic CLI Output## Vulnerability Details **File Location**: `SKILL.md`, lines 76–80 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code The Skill states that when a version-gate response is returned, the response message contains an upgrade command and the Agent should execute it exactly. The documented upgrade command is: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The instruction treats a dynamically generated CLI response as trusted executable guidance. The response can be influenced by the installed CLI and potentially by its remote service. Telling the Agent to follow a returned command “exactly” creates a command-execution boundary controlled by data that was not statically reviewed with the Skill. Even if legitimate responses currently contain only an npm upgrade command, the instruction does not require the Agent to parse the response as structured data, validate it against an allowlist, or reject shell metacharacters and unexpected executables. A compromised service, CLI package, update channel, or network trust path could therefore return an attacker-selected command. The fixed example is independently unsafe because `@latest` retrieves and executes a mutable remote package release. ### Attack Path 1. An attacker compromises the `qhkit` package, its backend service, or another component capable of controlling the version-response message. 2. The compromised component returns a version-stage error whose message contains a malicious shell command or directs installation of a malicious package release. 3. The Agent applies the Skill's instruction to execute the message exactly. 4. The attacker-controlled command runs in the Agent's local environment. 5. The command reads or modifies user-accessible files, steals environment credentials, uploads data, or installs additional user-level components. ### Impact Assessment Successful exploitation ...[truncated 556 chars]
• Remediation: ## Remediation Suggestions 1. Never execute shell commands contained in CLI output, API responses, error messages, or other remotely influenced text. 2. Treat a version response only as a structured signal that an upgrade may be required. 3. Define a hard-coded allowlist of permitted package-management operations. 4. Use a reviewed, exact package version and verified integrity value instead of `@latest`. 5. Display the proposed upgrade and obtain explicit user approval before making changes. 6. Reject response fields containing shell syntax, command substitutions, redirections, pipelines, or unexpected executable names. 7. Perform upgrades in an isolated environment and run post-installation verification before using the new CLI. 8. Separate status-message handling from command execution so text returned by the service can never reach a shell interpreter.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The keyword list is very broad and mixes platform names, common ecommerce terms, and vendor/product names without constraints, which makes accidental triggering likely. In a skill that installs software, requests API keys, uploads local images, and submits paid jobs, over-triggering materially raises operational and privacy risk because the agent may route benign conversations into sensitive external actions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The keyword list is very broad and mixes platform names, common ecommerce terms, and vendor/product names without constraints, which makes accidental triggering likely. In a skill that installs software, requests API keys, uploads local images, and submits paid jobs, over-triggering materially raises operational and privacy risk because the agent may route benign conversations into sensitive external actions.

Static analysis

No suspicious patterns detected.