AI电商服装换色 | 服装换色 | 换颜色 | SKU换色 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:18 AM UTC
• Version: 0.1.5

Overview

The skill appears to perform clothing recoloring as advertised, but it asks the agent to install and upgrade a global CLI in ways that need review.

Install only if you are comfortable letting this skill add or upgrade a global qhkit CLI, store or use a LinkPix token, and upload selected images to the service. Prefer a pinned, reviewed version in an isolated environment, and do not let the agent execute shell commands copied from tool output without human review.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:43
• Finding: Unpinned Third-Party Package Installation and Automatic Latest-Version Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–64 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: High ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to install `@iqinghu/qhkit` globally without pinning an exact audited version. It later explicitly installs the mutable `latest` release. The dependency's implementation is not included in the audited project, so its installation hooks, runtime behavior, credential handling, and future releases cannot be verified from this repository. A global npm installation may execute package lifecycle scripts and places an executable in the user's global command environment. The optional use of a mirror registry also expands the set of infrastructure trusted to deliver executable content. This behavior exceeds the minimum privileges needed where an isolated, locally pinned dependency would suffice. It does not inherently grant root privileges, but it executes package-controlled code with all permissions of the account running npm. If a user manually adds `sudo`, the resulting impact would increase to system-level compromise, although the Skill itself does not instruct the use of `sudo`. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, a future release, or trusted package-delivery infrastructure. 2. A malicious version is published under the expected package name or exposed through the mutable `latest` tag. 3. The Agent follows the Skill and executes the global installation or upgrade command. 4. Package lifecycle scripts or subsequently invoked CLI code run with the Agent account's privileges. 5. Malicious code reads accessible files or environment variables, steals the configured API token, modifies user-level executables, or exfiltrates submitted images and other accessible data. ### Impact Assessment Successful exploitation permits ar ...[truncated 581 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed version rather than using an implicit current version or `@latest`. 2. Record and verify package integrity using a lockfile and trusted integrity hashes. 3. Remove automatic upgrade behavior. Review each new release before changing the approved version. 4. Install the dependency locally in a dedicated project or isolated container instead of globally. 5. Run installation and image processing under a restricted, non-administrative account. 6. Disable npm lifecycle scripts with `--ignore-scripts` when the package can operate without them; otherwise, separately audit every required script. 7. Use an explicit allowlist of approved registries and avoid changing registries automatically after a timeout. 8. Restrict filesystem and environment access so the CLI receives only the required image and token. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:61
• Finding: Execution of Upgrade Instructions Derived from Untrusted CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Trusting tool-controlled command instructions **Risk Level**: High The vulnerable instruction states, in English, that when a version-gate response is returned, the response `message` contains the upgrade command and the Agent should follow it directly: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; follow it directly. ``` ### Technical Analysis The Skill treats text returned by the installed CLI as an authoritative source of shell commands. CLI output can be influenced by the locally installed package and potentially by remote service responses processed by that package. Neither source is part of this audited repository. Executing command text from a `message` field crosses a data-to-code trust boundary. A compromised package, spoofed executable, modified service response, or manipulated local command resolution could return shell metacharacters or an entirely unrelated command. The instruction provides no parsing, fixed-command validation, allowlist, or user confirmation requirement. The fixed upgrade command shown elsewhere in the file does not eliminate the issue because line 61 separately directs the Agent to obey command content supplied dynamically by the tool. ### Attack Path 1. An attacker compromises `qhkit`, places a spoofed `qhkit` earlier in `PATH`, or controls a remote response consumed by the CLI. 2. The malicious component returns a response resembling: ```json {"ok":false,"stage":"version","message":"<attacker-controlled command>"} ``` 3. The Agent interprets the `message` as an authorized upgrade command because the Skill explicitly says to follow it. 4. The attacker-controlled command executes in the Agent's shell. 5. The command can access local data, credentials, network services, and writable command paths available to the Agent account. ### Impact Assessment Succe ...[truncated 511 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute commands contained in CLI output. 2. Treat all `message`, stderr, and remote-response content as untrusted display-only data. 3. Implement upgrades through a hard-coded allowlisted command using an exact reviewed version. 4. Validate that the resolved executable path is the expected trusted binary before invocation. 5. Require explicit user approval before installing or upgrading executable dependencies. 6. Reject responses containing shell commands, shell metacharacters, URLs, or installation instructions rather than forwarding them for execution. 7. Run upgrades in an isolated environment with restricted filesystem, credential, and network access. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill metadata says the skill 'must trigger' for a long list of common recoloring-related phrases, but it does not define exclusion conditions or precedence against similar image-editing skills. This can cause over-invocation, making the agent route unrelated or ambiguous user requests into this skill and potentially perform unnecessary installs, external API calls, or image processing without clear user intent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation section provides only positive examples of when to activate and no boundaries for when not to activate, despite nearby overlapping capabilities like outfit changing and pattern-variant generation. In an agentic environment, this ambiguity increases the chance of incorrect tool selection, unintended external command execution, and user confusion or unwanted processing of uploaded images.

Static analysis

No suspicious patterns detected.