AI电商带货视频 | 口播视频 | 商品促销视频 | 商品测评视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

This skill is for a real video-generation workflow, but it pushes broad activation and automatic global software installation in ways users should review first.

Install only if you are comfortable using LinkPix/qhkit, uploading selected media to that service, and potentially spending service credits. Before use, require confirmation before installing or upgrading software, prefer a pinned/local qhkit install, avoid executing upgrade commands copied from tool output, and confirm the exact files and estimated cost before generation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57
• Finding: Unpinned Global Installation of a Mutable Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, lines 57–86 **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The documented upgrade procedure later installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit switching from the official npm registry to: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the agent to install a third-party npm package globally without pinning an audited version or verifying package integrity. The upgrade procedure explicitly requests the `latest` tag, whose target can change after the Skill has been audited. npm installation can execute package lifecycle scripts and place executables in a global binary location. Consequently, the effective code executed by the Skill is controlled by future package releases and the selected registry rather than by the reviewed `SKILL.md` file. The registry fallback additionally expands the supply-chain trust boundary. No evidence establishes that the named package or mirror is currently malicious. The vulnerability is the mutable, unverified, global installation mechanism. ### Attack Path 1. An attacker compromises the package publisher account, package release process, or an accepted registry path. 2. The attacker publishes a malicious release and moves the `latest` tag to it, or serves a compromised package through the registry path. 3. A user invokes the Skill on a system without `qhkit`, or the CLI reports that an upgrade is required. 4. The agent runs the documented global npm installation command. 5. Malicious lifecycle scripts or CLI code execute with the operating-system privileges of the agent process. 6. The installed global executable remains available to later shell sessions until removed or replaced. ### Impact Assessment ...[truncated 615 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an unqualified package name or `@latest`. 2. Verify the package using an approved lockfile and npm integrity metadata. 3. Prefer a project-local, isolated installation over `npm i -g`. 4. Disable lifecycle scripts during installation where compatible, then explicitly run only reviewed setup steps. 5. Restrict installation to an administrator-approved registry and avoid automatic registry fallback. 6. Require explicit user approval before installing or upgrading executable dependencies. 7. Review each new version before changing the pinned version. 8. Run the CLI in a sandbox with access limited to the media files and network destinations required for the requested task.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:79
• Finding: Dynamic CLI Response Is Treated as Executable Upgrade Guidance## Vulnerability Details **File Location**: `SKILL.md`, lines 79–82 **Vulnerability Type**: Unvalidated command execution guidance **Risk Level**: Medium ### Vulnerable Instruction The Skill states that when the CLI returns a version-stage failure, the response message contains the upgrade command and the agent should follow that command directly. The associated fixed example is: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The upgrade workflow establishes a trust relationship in which text returned by the installed CLI is accepted as command guidance. The instructions do not require the response to match an allowlisted command template, do not validate a returned version, and do not prohibit shell metacharacters or additional commands. CLI output may be influenced by the installed package or its remote backend. If either component is compromised, the returned `message` field becomes an indirect command-injection channel. This is distinct from merely displaying an error message because the Skill expressly instructs the agent to act on the command contained in that message. ### Attack Path 1. An attacker compromises the installed CLI, its update-check service, or a backend response used to construct the version-stage message. 2. The compromised component returns a version error whose `message` contains a malicious shell command disguised as upgrade guidance. 3. The agent follows the Skill instruction to execute the command from the message directly. 4. The attacker-supplied command executes in the local shell with the agent user's privileges. 5. The command can then access local files and credentials or install additional executable content. ### Impact Assessment Exploitation could produce arbitrary command execution with the privileges of the account running the Skill. Accessible API tokens, environment variables, local media, configuration files, and user-writable files would be exposed. Th ...[truncated 198 chars]
• Remediation: ## Remediation Suggestions 1. Never execute commands extracted from a CLI or backend response. 2. Treat the response message as display-only diagnostic text. 3. Implement a fixed, locally defined upgrade command with no response-controlled shell syntax. 4. If a version is returned, validate it against a strict semantic-version expression and pass it as a non-shell argument. 5. Reject whitespace, shell metacharacters, URLs, package-name changes, registry overrides, and additional arguments in version data. 6. Require explicit user confirmation before every installation or upgrade. 7. Pin upgrades to reviewed versions instead of accepting `latest`.

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:3
• Finding: Generic Video Requests Are Force-Routed to a Proprietary Remote Service## Vulnerability Details **File Location**: `SKILL.md`, line 3 **Vulnerability Type**: Overbroad mandatory Skill activation **Risk Level**: Low ### Vulnerable Configuration ```yaml description: ... When the user requests generating or making videos, product videos, advertising videos, promotional videos, or one-click video creation, this Skill must trigger. ... ``` The subsequent workflow directs the agent to install `qhkit`, obtain a service token, upload local media, and submit potentially chargeable remote-generation jobs. ### Technical Analysis The activation instruction captures broad, vendor-neutral video requests rather than limiting activation to users who explicitly request LinkPix or `qhkit`. Loading the Skill can therefore alter tool selection for the current session and route generic tasks into a proprietary installation, registration, upload, and billing workflow. The remote service is relevant to the declared functionality, and no covert upload was identified: the document states that local image and video paths are uploaded by the CLI. The issue is that mandatory broad activation can cause this vendor-specific workflow to be selected without an explicit vendor choice or prior consent. ### Attack Path 1. A user makes a generic request to create or edit a video without naming LinkPix or `qhkit`. 2. The broad mandatory trigger activates this Skill. 3. The workflow prompts installation of the proprietary CLI and creation or configuration of a vendor token. 4. Local media supplied by the user is uploaded to the vendor service. 5. A generation operation may consume service credits, and generated content is returned through vendor-hosted URLs. ### Impact Assessment This behavior can cause unintended disclosure of user media to a third-party service, unnecessary software installation, vendor account creation, and consumption of paid credits. It does not independently grant elevated operating-system privilege ...[truncated 258 chars]
• Remediation: ## Remediation Suggestions 1. Trigger the Skill automatically only when the user explicitly requests LinkPix or `qhkit`. 2. For generic video requests, present available processing options without forcing a particular vendor. 3. Before installation or account setup, disclose the package name, installation scope, remote service, and credential requirements. 4. Before uploading media, identify the files and destination service and obtain explicit user consent. 5. Run an estimate and obtain confirmation before submitting any chargeable task. 6. Avoid redirecting unsupported requests to a vendor website unless the user asks for an external alternative.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The manifest says generic requests to generate or make videos 'must trigger' this skill, which is an overbroad routing rule that can hijack unrelated user intents and force use of an external CLI/service. In an agent environment, that increases the chance of unsolicited tool invocation, package installation, token prompts, or data transfer for requests that only loosely mention video.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to bootstrap the environment by installing Node, installing a global npm package, changing PATH, and using alternate registries, while explicitly saying not to give up if dependencies are missing. Without an explicit user-consent gate for system modification, this can cause unauthorized changes to the host environment and expand supply-chain risk through remote downloads and package execution.

Static analysis

No suspicious patterns detected.