抖音小店 商品图、主图套图、详情图、活动图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims for AI product-image generation, but its setup asks users to share an API key in chat and relies on broad unpinned runtime installs.

Review before installing. Use a dedicated low-scope Qinghu token, avoid pasting long-lived API keys into chat if your platform offers a secret manager, and prefer a pinned/local or sandboxed qhkit installation over global @latest installs where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:54
• Finding: Unpinned Third-Party Packages Are Installed and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-57; line 80; line 93 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code Snippets ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The Skill also directs the agent to use runtime package execution and installation mechanisms: ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npx --yes sharp-cli ... ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ### Technical Analysis The Skill installs or directly executes third-party packages without pinning their versions or validating their package artifacts against trusted integrity values. In particular, `@latest` explicitly resolves to whatever release the package publisher currently designates, while `npx --yes` can download and execute a package without an additional confirmation step. This creates a time-of-review/time-of-execution gap: the code executed when the Skill is invoked may differ from the code that existed during this audit. npm lifecycle scripts and package entry points can execute arbitrary commands with the permissions of the agent process. The optional npm and Python mirrors introduce additional supply-chain trust boundaries. Global npm installation is broader than necessary for a single image-generation task. It modifies the user's shared tool environment and may affect subsequent sessions or other applications using the same command name. ### Attack Path 1. An attacker compromises a package publisher account, package repository, release pipeline, or configured package mirror. 2. The attacker publishes a malicious release of `@iqinghu/qhkit`, `sharp-cli`, Pillow, or a transitive dependency. 3. The agent follows the Skill's bootstrap or upgrade instructions. 4. npm, npx, or pip resolves and downloads the attacker-controlled package version. 5. Package lifecycle scripts or runtime entry points execute with the agen ...[truncated 1093 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an audited exact version rather than using unversioned packages or `@latest`. 2. Verify downloaded package artifacts using trusted integrity hashes, signed provenance, or registry signatures. 3. Use a project-local installation with a lockfile instead of global installation. 4. Run third-party tooling in an isolated container or sandbox with restricted filesystem and network access. 5. Disable or tightly control package lifecycle scripts where operationally possible. 6. Do not use `npx --yes` for packages that have not already been pinned and verified. 7. Require explicit user approval before installing or upgrading executable dependencies. 8. Avoid switching registries automatically. If a mirror is necessary, document its trust assumptions and verify artifacts independently. 9. Separate image processing into a preinstalled, reviewed component rather than downloading image-processing tools during a task. 10. Replace automatic upgrade instructions with a controlled process that reviews and pins each new version before deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: API Token Is Requested Through Chat and Passed in a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 69-75 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code Snippet ```bash qhkit config set --token <API_KEY> --env prod ``` The surrounding instructions direct the user to copy an API key and send it to the agent before this command is executed. ### Technical Analysis The workflow handles an authentication secret through two observable channels: 1. The user is instructed to disclose the API token in the conversation. 2. The token is supplied as a command-line argument. Conversation transcripts may be retained in application logs, agent traces, support exports, or tool-call records. Command-line arguments may be exposed through process inspection, shell history, debugging output, telemetry, or execution logs. Masking the output of `qhkit config show` does not remove the earlier exposures. This is an insecure secret-handling pattern even if the underlying CLI stores the token securely after configuration. The token should be delivered through a dedicated secret-management mechanism and must not appear in conversational or command-line records. ### Attack Path 1. The user creates or copies a Qinghu API token. 2. Following the Skill's instructions, the user sends the token in the agent conversation. 3. The agent interpolates the token into the `qhkit config set --token ...` command. 4. The plaintext token is retained in one or more locations, such as conversation history, tool-call logs, process metadata, shell history, or telemetry. 5. A person or process with access to any retained record retrieves the token. 6. The exposed token is reused to invoke the remote service under the user's account. ### Impact Assessment An attacker who obtains the token may be able to authenticate to the Qinghu service with the user's account permissions. Depending on the service-side authorization associated with the token, this may allow: - Unauth ...[truncated 451 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys into the agent conversation. 2. Integrate with the host platform's secret manager or protected credential-entry interface. 3. Prefer a securely injected environment variable such as `QHKIT_TOKEN`, provided it is configured outside the conversation and excluded from logs. 4. If interactive configuration is required, use a hidden-input prompt that reads the token from standard input. 5. Avoid passing secrets through command-line arguments. 6. Redact secrets from agent traces, command logs, telemetry, error messages, and support bundles. 7. Prevent shell history recording during sensitive configuration operations. 8. Store the token with restrictive filesystem permissions and document where it is retained. 9. Provide token revocation and rotation instructions in case accidental disclosure occurs. 10. Use narrowly scoped, short-lived tokens where the service supports them. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.