Grok 爆款视频复刻 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:18 AM UTC
• Version: 0.1.1

Overview

The skill’s video-generation purpose is clear, but it asks users to paste an API key into chat and directs agents to install mutable third-party tools automatically.

Review this skill before installing. It appears intended for legitimate LinkPix/Qinghu AI video generation, but use a secure secret-entry method instead of pasting API keys into chat, avoid unpinned global installs or @latest upgrades where possible, and only run the local compression/install steps in a sandboxed environment with files you trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52
• Finding: Unpinned Third-Party Packages Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52`, `SKILL.md:78`, and `SKILL.md:91` **Vulnerability Type**: Unpinned executable dependencies and mutable package sources **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` The instructions also permit npm packages to be retrieved through an alternative registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the agent to retrieve and execute third-party packages without pinning reviewed versions or verifying package integrity. In particular: - `@iqinghu/qhkit` is installed without an exact version. - `@iqinghu/qhkit@latest` deliberately resolves to mutable future content. - `npx --yes sharp-cli` retrieves and executes a package without interactive review. - Pillow and npm packages may be obtained from additional mirror infrastructure, expanding the supply-chain trust boundary. - No lockfile, package integrity value, signature verification, or vendored reviewed implementation is included in the project. Package installation normally executes package-controlled code, including installation hooks. The subsequently installed command-line programs also execute with the permissions of the agent account. This behavior is related to the declared functionality because `qhkit` is the service client, but automatic installation and mutable upgrades exceed the minimum privilege and trust necessary to use a preinstalled, reviewed client. The separate Node.js archive installation is not included in this finding. It pins Node.js to version `22.22.3` and checks the archive against the downloaded checksum manifest before extraction. The pre-scan characterization of line 61 as `curl | bash` is inaccurate: the remote data is piped to `grep` and `sha256sum ...[truncated 1328 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every executable dependency to an exact, reviewed version. 2. Provide and enforce lockfiles and registry integrity hashes where supported. 3. Remove automatic `@latest` upgrades and do not execute upgrade commands supplied dynamically by remote error messages without validation. 4. Avoid `npx --yes`; install a pinned, reviewed `sharp-cli` version or use an included local image-processing implementation. 5. Use trusted primary registries by default and require explicit user approval before switching to a mirror. 6. Verify package signatures or checksums independently of the package distribution channel where possible. 7. Require explicit user consent before installing or upgrading executable software. 8. Prefer a sandboxed, non-privileged environment with restricted filesystem, credential, and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:67
• Finding: API Token Is Requested Through Chat and Passed in a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-71` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```text 4. **密钥**：无密钥时（命令返回 `stage:"config"`），把下面的引导文案发给用户，拿到密钥后执行 `qhkit config set --token <密钥> --env prod`（或设环境变量 `QHKIT_TOKEN`）： > 1. 打开 https://www.iqinghu.com/workbench/login?type=1&urlCode=1788417429126 注册/登录 > 2. 进入控制台 → 工作台的 APIKeys 页面：https://www.iqinghu.com/workbench/dashboard/api-keys > 3. 点「创建/复制」生成密钥，生成后将 API 密钥发我 > > 图文获取密钥教程：https://xcnzsfe4uxrw.feishu.cn/wiki/KJ0Ywsyw8iAXmRkz5l4cddDbn6g ``` The relevant command is: ```bash qhkit config set --token <密钥> --env prod ``` The text explicitly instructs the user to send the API key to the agent. ### Technical Analysis The workflow causes a service credential to enter the conversational context and then places it directly in a process argument. This creates several independent exposure channels: - Conversation histories and model-provider logs. - Agent traces, tool-call records, and diagnostic telemetry. - Shell history if the command is executed through an interactive shell. - Process command-line inspection while the command is running. - Error output or debugging logs that reproduce the command. An environment variable is mentioned as an alternative, but environment variables can also leak through child processes, crash diagnostics, or environment logging. More importantly, the workflow first asks the user to disclose the secret in chat, so choosing the environment-variable alternative does not eliminate the initial exposure. The token is legitimately required to authenticate to the declared cloud service, but disclosure to the model conversation is not necessary. Credential collection therefore exceeds the minimum information exposure required for the Skill's functionality. ### Attack Path 1. The Skill detects that `qhkit` has not been configured. 2. It directs the user to create and send an API key through th ...[truncated 1121 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never ask users to paste API keys into the conversation. 2. Use an out-of-band secret-entry interface, operating-system keychain, protected secret manager, or hidden interactive prompt. 3. Pass credentials through a protected standard-input channel or narrowly scoped secret injection mechanism rather than command-line arguments. 4. Ensure the model cannot read or reproduce the secret after configuration. 5. Disable shell command echoing and redact credentials from agent traces, errors, telemetry, and audit logs. 6. Store the token with restrictive filesystem permissions and document its storage location. 7. Use short-lived, least-privilege tokens where supported. 8. Provide token revocation and rotation instructions if a credential has already been pasted into chat. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:91
• Finding: Untrusted File Paths Can Be Interpolated into Executable Python Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:91` **Vulnerability Type**: Command and source-code injection through unsafe filename substitution **Risk Level**: High ### Vulnerable Code ```bash python -c "from PIL import Image, ImageOps; im=ImageOps.exif_transpose(Image.open('原图')); im.thumbnail((2048,2048)); im.convert('RGB').save('压缩后.jpg', quality=85)" ``` The instruction tells the agent to replace the input and output placeholders with actual local file paths before executing the command. ### Technical Analysis The input and output paths are embedded directly inside Python string literals contained within a shell command. If a path contains a single quote, backslash sequence, newline, or deliberately crafted Python expression, it can terminate the intended string literal and inject additional Python statements. For example, a maliciously controlled filename could conceptually close `Image.open('...')`, insert Python code, and then comment out or neutralize the remaining source. Shell metacharacters and quoting characters can also cause unintended shell parsing if substitution is performed without rigorous escaping. This is not merely a file-not-found or compatibility problem: the generated `python -c` argument is executable source code. Treating an untrusted path as part of that source violates the separation between code and data. Exploitation depends on the agent performing literal placeholder substitution with an attacker-influenced path. User-provided media paths and uploaded filenames can be attacker-controlled in the declared workflow, making that condition plausible. ### Attack Path 1. An attacker supplies an oversized image or causes an image to be stored under a filename containing crafted quote and Python syntax. 2. The image exceeds the documented 10 MB threshold, triggering the local compression procedure. 3. The agent substitutes the crafted path for the `原图` placeholder in the `python -c` command. 4. The substituted ...[truncated 864 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never interpolate file paths into Python source code. 2. Pass paths as positional command-line arguments and retrieve them through `sys.argv` or `argparse`. For example: ```bash python resize_image.py --input "$input_path" --output "$output_path" ``` 3. In the Python script, treat both values strictly as data: ```python import argparse from PIL import Image, ImageOps parser = argparse.ArgumentParser() parser.add_argument("--input", required=True) parser.add_argument("--output", required=True) args = parser.parse_args() image = ImageOps.exif_transpose(Image.open(args.input)) image.thumbnail((2048, 2048)) image.convert("RGB").save(args.output, quality=85) ``` 4. Invoke subprocesses with argument arrays and `shell=False` rather than constructing shell command strings. 5. Generate the output filename internally in a controlled temporary directory. 6. Reject paths containing NUL bytes and validate that the resolved input is an expected regular file. 7. Apply restrictive permissions to temporary output and remove temporary files after delivery. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to bootstrap the environment by downloading and installing Node.js and the qhkit package, including fallback registries and shell PATH modification. Even if framed as reliability guidance, this expands the agent's authority from using an existing tool to altering the host environment and fetching code from the network, which creates supply-chain and system-integrity risk unrelated to answering the user safely.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill tells the agent to perform local image transcoding/compression and, if needed, install extra dependencies such as Pillow or sharp-cli. That causes the agent to manipulate local files and pull additional packages from package indexes, increasing attack surface and creating opportunities for unsafe file handling or dependency abuse beyond the core skill purpose.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to ask the user to paste an API key directly into chat and then use it in a command line argument. This encourages transmission and handling of sensitive credentials in plain text, where they may be exposed in chat logs, agent memory, shell history, telemetry, or process listings. In this context, the danger is elevated because the skill is operational and explicitly normalizes collecting secrets rather than redirecting users to a secure secret-entry mechanism.

Static analysis

No suspicious patterns detected.