AI生成电商图 | 电商主图 | 电商详情图 | 电商白底图 | 电商活动图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:32 AM UTC
• Version: 0.1.5

Overview

This ecommerce image skill is coherent, but it needs review because it directs automatic tool installation/upgrades and external image uploads without a clear user confirmation gate.

Review this skill before installing. Only use it if you are comfortable with qhkit/LinkPix processing your product images externally, consuming service credits, and storing a token for the service. Do not allow automatic global installs, Node downloads, PATH changes, or @latest upgrades unless you explicitly approve them and trust the npm package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55
• Finding: Unpinned Third-Party CLI Installation and Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md`, lines 55-62 and 79-81 **Vulnerability Type**: Unpinned executable dependency and mutable supply-chain retrieval **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the agent to install an executable npm package globally without pinning it to a reviewed version. It also instructs the agent to install the mutable `latest` release automatically when certain version signals appear. npm installation can execute package lifecycle scripts, while subsequent CLI invocations execute package-controlled code with the privileges of the agent's operating-system account. Because the resolved package version can change after the Skill has been audited, the effective executable payload is not fixed by the reviewed project. Global installation is broader than necessary for a single image-generation operation. It makes the package available outside the immediate task and may modify user-level or system-level executable paths, depending on npm configuration. The optional registry mirror further expands the supply-chain trust boundary. No evidence shows that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and upgrade policy. ### Attack Path 1. An attacker compromises the package maintainer account, an authorized publisher, the npm distribution path, or the configured mirror. 2. The attacker publishes a malicious release under the legitimate package name. 3. The agent encounters a system without `qhkit`, or receives one of the documented upgrade signals. 4. The agent executes the unpinned global installation or the `@latest` upgrade. 5. Malicious lifecycle code may execute during installation, or malicious package code executes when `qhkit` is invoked. 6. The payload runs with the privileges of the agent's operating-sy ...[truncated 888 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed instead of using an unqualified package name or `@latest`. 2. Record and verify package integrity using a lockfile or an expected registry integrity digest. 3. Do not automatically upgrade in response to remote version messages. Require explicit user or administrator approval before installing a new executable version. 4. Prefer an isolated, project-local installation over global installation. 5. Run the CLI in a sandbox with access restricted to the specific input files and required network destinations. 6. Where compatible with the package, disable npm lifecycle scripts during installation and separately review any required installation scripts. 7. Treat registry mirrors as separate trust boundaries. Document the mirror policy and require the same package-integrity verification regardless of source. 8. Avoid exposing unrelated environment variables or credentials to the installed process.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:89
• Finding: Automatic Upload of Local User Images Without an Explicit Consent Gate## Vulnerability Details **File Location**: `SKILL.md`, lines 89-91 **Vulnerability Type**: Undisclosed external transfer of local files **Risk Level**: Low ### Vulnerable Instruction The relevant instruction states that image and video parameters may be local file paths and that the CLI automatically uploads those files to obtain externally usable URLs. ```text Image and video parameters may contain local file paths. The CLI automatically uploads those files and obtains URLs. Public HTTP or HTTPS URLs may also be supplied for material already hosted online. ``` This is an English rendering of the complete relevant instruction in `SKILL.md`. ### Technical Analysis The Skill instructs the agent to pass local image paths directly to a third-party CLI. The CLI then uploads those files to an external service automatically. External processing is consistent with the declared cloud image-generation functionality, so this behavior is not covert or unrelated exfiltration. However, the Skill does not require the agent to obtain explicit user consent before the first upload, identify the receiving service at the point of transfer, or explain applicable retention and privacy implications. A user may reasonably interpret a local file reference as permission to process the file without understanding that the file leaves the local environment. Product images can contain confidential designs, unreleased products, embedded metadata, customer information, or other commercially sensitive content. Automatically transmitting them without a clear consent gate is an insecure data-handling practice. ### Attack Path 1. A user asks the agent to create an e-commerce image and provides or references a local file. 2. The agent follows the Skill and places the local path in `uploadedImages`. 3. The agent invokes `qhkit image generate`. 4. The CLI reads the local file and uploads it to the external LinkPix or Qinghu service. 5. The external ...[truncated 917 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before the first local file is uploaded to the external service. 2. State clearly which service receives the file and provide relevant privacy, retention, and deletion information. 3. Display the exact files selected for upload and prevent directory-wide or unintended file selection. 4. Restrict CLI filesystem access to the files approved by the user. 5. Remove unnecessary metadata from images before upload when doing so will not impair the requested task. 6. Warn users not to submit confidential, regulated, or unreleased materials unless authorized. 7. Document how uploaded assets and generated outputs are stored, retained, shared, and deleted. 8. Provide a cancellation or local-processing alternative where technically available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The manifest description says the skill 'must trigger' for very common image-generation requests, including broad phrases like generating product images, marketing images, or turning one product image into a set of ecommerce images. That creates an over-broad routing rule that can preempt user intent and cause the agent to invoke this skill in many ordinary image tasks, potentially leading to unexpected third-party API calls, uploads of user images, and costs without sufficiently specific consent. In this skill's context, the risk is elevated because the tool is networked, can upload local files, and is explicitly designed as a mandatory entry point for a wide class of requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to bootstrap the environment by installing Node, installing a global npm package, configuring API tokens, and downloading binaries over the network, but it does not present a clear user-facing warning or approval gate before making system changes. This is dangerous because an agent following these instructions could modify the host environment, fetch external code, and alter PATH or configuration state without explicit user authorization, increasing supply-chain, persistence, and privacy risks. The danger is higher here because the instructions explicitly say not to give up if dependencies are missing and to 'install what's missing' automatically.

Static analysis

No suspicious patterns detected.