Security audit
Security checks for vulnerabilities and agentic risk
The skill is for clothing image recoloring, but it also tells the agent to install and update tooling and change service configuration with limited user confirmation.
Review this skill before installing if you do not want an agent to install npm packages, update qhkit, download Node, upload clothing images to LinkPix/iqinghu, or change qhkit token/site configuration. Prefer approving setup steps explicitly and pinning package versions where possible.
The trigger language is very broad and says the skill 'must' be invoked for common clothing color-change requests. Overbroad mandatory triggering can cause unnecessary tool execution, increasing exposure to installation, credential prompting, and external service use even when a simpler or safer response would suffice.
The skill contains detailed installation and shell commands that download software, install global npm packages, set tokens, and modify PATH/environment behavior, but it does not require explicit user consent before making those changes. In an agent setting, this can lead to unauthorized system modification, credential handling, and execution of network-fetched code.
The skill recommends executing npx @iqinghu/qhkit <命令> ... without pinning an exact package version. That allows the fetched code to vary over time and exposes users to supply-chain risk if a malicious or compromised package version is published, especially because the skill also instructs users to execute it directly from the network.
This duplicate finding points to the same persistence behavior: installing binaries under $HOME/.local/lib and altering PATH so future shells may use the new Node.js binary. Even though checksum verification is included, the persistence aspect still increases risk because it changes the execution environment beyond the immediate task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: installing binaries under $HOME/.local/lib and altering PATH so future shells may use the new Node.js binary. Even though checksum verification is included, the persistence aspect still increases risk because it changes the execution environment beyond the immediate task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to force the cn site configuration by default and to override existing intl settings unless the user explicitly states otherwise. This can redirect authentication and API usage to a different region than the user's intended environment, risking misconfiguration, account confusion, and accidental credential exposure to the wrong service context.