GPT Image 2 爆款电商主图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.1

Overview

This is a coherent image-generation skill, but it needs review because it asks users to send an API key in chat and installs unpinned global tools.

Install only if you are comfortable with qhkit/LinkPix receiving your prompts and reference images. Do not paste API keys into chat; configure the token yourself through a secure local secret mechanism and rotate it if it was shared. Prefer pinned, isolated installs over global npm or npx execution, and review credit estimates before allowing generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52
• Finding: Unpinned Third-Party Executable Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-69`, `SKILL.md:84-90`, and `SKILL.md:95-101` **Vulnerability Type**: Supply-chain exposure through mutable executable dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` The same instructions also permit alternate package and binary mirrors: ```bash npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com ``` ```bash cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" ``` ### Technical Analysis The Skill directs the Agent to download and execute mutable third-party packages without a lockfile, fixed package versions, package integrity values, or a documented review of package contents. The explicit `@latest` upgrade makes the executed implementation dependent on whichever release is current at invocation time. `npx --yes` similarly downloads and runs a package without interactive review. Global npm installation modifies the user's shared executable environment rather than using an isolated, task-specific environment. This exceeds the minimum privilege needed for a single image-generation request and may affect other sessions or tools that resolve the globally installed binary. Use of alternate npm and Python mirrors expands the set of infrastructure that must be trusted. A compromised maintainer account, upstream release, package registry, mirror, or dependency could introduce executable code after this Skill has been reviewed. The Node.js archive workflow is better protected: it uses a fixed HTTPS URL ...[truncated 1766 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit`, Pillow, and `sharp-cli` to reviewed versions rather than using implicit latest versions or `@latest`. 2. Record and verify package integrity hashes, and use lockfiles where the package manager supports them. 3. Remove automatic upgrade instructions. Present the proposed version and require explicit user approval before changing executable dependencies. 4. Prefer a project-local or isolated installation over `npm i -g`, such as a dedicated directory, container, or restricted virtual environment. 5. Avoid `npx --yes` for unreviewed packages. Preinstall a reviewed image-processing utility or invoke a pinned package with verified integrity. 6. Restrict package lifecycle scripts where feasible and review the dependency tree before execution. 7. Prefer primary registries. If a mirror is necessary, document its trust assumptions and verify artifacts against integrity data obtained from an independent trusted source. 8. For Node.js, pin the expected archive digest in the reviewed Skill or verify a signed release manifest rather than downloading both the archive and checksum from the same endpoint. 9. Run downloaded tools in a sandbox with access limited to the specific input and output files required for image processing. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74
• Finding: API Token Exposure Through Conversation and Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:74-81` **Vulnerability Type**: Insecure handling of authentication secrets **Risk Level**: Medium ### Vulnerable Code ```text 3. Click “Create/Copy” to generate a key, then send the API key to me ``` ```bash qhkit config set --token <API_KEY> --env prod ``` The Skill also proposes an environment variable as an alternative: ```bash QHKIT_TOKEN ``` ### Technical Analysis The Skill instructs the user to send an API key to the Agent through the conversation. Secrets supplied this way may be retained in chat history, Agent traces, audit logs, model-provider telemetry, or other session records. The subsequent command passes the token directly as a command-line argument. Depending on the operating system and execution environment, command arguments may be visible in shell history, process listings, command logs, monitoring systems, or Agent tool traces. Using `QHKIT_TOKEN` can reduce exposure through process arguments, but it is not sufficient if the token is first collected in the conversation or if the execution platform logs environment variables. The Skill does not specify redaction, restricted secret storage, token lifetime, rotation, or revocation procedures. ### Attack Path 1. The user follows the Skill instructions and posts the QHKIT API token in the conversation. 2. The token is retained in chat history, Agent execution traces, or platform logs. 3. The Agent invokes `qhkit config set --token ...`, potentially exposing the same token through command logging, shell history, or process inspection. 4. A person or process with access to any of these records retrieves the token. 5. The attacker authenticates to the QHKIT service and performs requests under the victim's account. 6. The attacker may consume paid credits or access service functionality available to that credential until the token is revoked. ### Impact Assessment Exploitation may permit unauthorized use of the associated QHKI ...[truncated 398 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys into the conversation. 2. Direct users to configure the token themselves through a masked interactive prompt, platform secret manager, or protected credential interface. 3. Avoid placing secrets in command-line arguments. Read the token from a protected file descriptor, masked standard input, or a secret-manager integration. 4. If an environment variable is used, populate it outside the Agent conversation and ensure the execution platform does not record environment values. 5. Store credentials with restrictive file permissions and avoid plaintext persistence where possible. 6. Ensure all command output and Agent traces redact token values. 7. Recommend narrowly scoped, short-lived credentials where supported. 8. Document token rotation and immediate revocation procedures for suspected disclosure. 9. Require the user to confirm only that configuration is complete; the Agent should never display or repeat the secret. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The metadata description includes very broad activation wording such as triggering whenever a user asks to make e-commerce images, posters, text-to-image, or image-to-image content. That can cause the skill to activate outside a narrowly scoped use case and route generic image requests into a tool flow that performs installation, uploads files, and potentially requests credentials. In this context, overbroad routing increases the chance of unnecessary exposure to external services and secret-handling paths.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger section uses ambiguous conditions like '要效果好、有免费额度的自定义生图,' which are subjective and not sufficiently bounded. That makes the skill eligible for activation on many unrelated image requests, increasing the likelihood that the agent invokes external tooling or begins setup steps when the user did not intend this specific service. Because this skill can lead to package installation, remote API use, and credential collection, ambiguous triggering is more risky than in a purely informational skill.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to ask the user to send an API key in chat and even provides copy directing the user to '将 API 密钥发我.' Collecting secrets through natural-language chat is dangerous because chat transcripts may be retained, exposed to the model, or mishandled by downstream logging and monitoring systems. In a skill that integrates with an external service, this creates a direct credential-compromise path.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This is a direct secret-collection pattern: the skill operationalizes credential capture by telling the agent to request the API key from the user and then use it in a command. That creates a high-probability path for leaking reusable credentials via conversation history, model context, telemetry, or operator access. The surrounding context makes it more dangerous because the key grants access to a third-party service and the instructions normalize sending it over chat.

Static analysis

No suspicious patterns detected.