Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed e-commerce video-generation skill, but users should understand it installs and runs an external CLI, uses an API token, and uploads provided media to the service.
Install only if you trust the qhkit/iqinghu service and are comfortable sending selected product images or videos to it. Prefer reviewed or pinned qhkit versions where possible, avoid adding PATH changes to shell startup files unless needed, and treat API tokens and paid-credit generation as deliberate user-approved steps.
The manifest says generic requests to generate or make videos 'must trigger' this skill, using very broad matching terms. That can cause over-invocation and unsafe routing, where unrelated user requests are pushed into an external tool flow that may install software, request credentials, or send media to third-party services without sufficiently specific user intent.
The description is written to force Chinese-language behavior and Chinese-platform assumptions regardless of the user's preferred language. This is mainly a policy/UX issue, but it can become a security concern if it leads users to follow instructions they do not understand, especially around installation, authentication, and third-party service usage.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain risk: a compromised latest release or unexpected breaking update could execute unreviewed code on the host during fallback installation.
The skill directs installation of Node into $HOME/.local/lib and modifies PATH, with later guidance to persist it in shell startup files. Even though framed as setup, this establishes user-level persistence and changes future command resolution, increasing the blast radius if the installed binaries or fetched archives are ever compromised.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs installation of Node into $HOME/.local/lib and modifies PATH, with later guidance to persist it in shell startup files. Even though framed as setup, this establishes user-level persistence and changes future command resolution, increasing the blast radius if the installed binaries or fetched archives are ever compromised.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"