ClawHub
Back to skill

Security audit

GPT Image 2 爆款电商主图 | LinkPix

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for generating e-commerce images, but it asks agents to perform broad automatic setup with unpinned remote package execution and persistent environment changes.

Review this skill before installing if you do not want agents to install or upgrade npm packages automatically, store a QHKIT token, or upload product images to iqinghu.com. Prefer pinned package versions and ask the agent to get explicit approval before changing Node/npm/qhkit or submitting any paid generation task.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says the skill 'must' trigger for broad classes of requests around GPT Image 2 and e-commerce image generation, creating an overly broad activation scope. In context, this can cause the agent to invoke installation, configuration, token-handling, and external CLI workflows for generic image requests that may not require this skill, increasing exposure to unnecessary external actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger section uses ambiguous phrases like requests for better effects, free quota, or generic cross-border main-image refinement, which are not precise invocation conditions. In this skill, such ambiguity is more dangerous because activation leads to external package installation, account/token guidance, and remote service usage, so accidental invocation materially expands risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs the agent to execute npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is latest at execution time to run. Because npx fetches and executes remote package code, a compromised upstream release or dependency-chain attack could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This duplicate finding identifies the same persistence behavior: unpacking Node into the home directory and updating PATH so future commands can use it. Even with checksum verification, the skill normalizes persistent environment modification as part of routine execution, which is risky because it enables long-lived changes and trust in newly introduced binaries.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This duplicate finding identifies the same persistence behavior: unpacking Node into the home directory and updating PATH so future commands can use it. Even with checksum verification, the skill normalizes persistent environment modification as part of routine execution, which is risky because it enables long-lived changes and trust in newly introduced binaries.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The fallback image-compression command uses npx --yes sharp-cli with no version pin, causing execution of an unpinned remote package at runtime. In an agent skill context, this is especially risky because it turns routine file handling into a remote code execution path if the package or one of its dependencies is malicious or hijacked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

L108 instructs that failure messages should be relayed as Chinese because they are 'user-facing Chinese', which implies a fixed language choice. The file does not offer a user language preference or state that Chinese is required for a justified region-specific compliance reason.

Content

No source excerpt is available for this finding.