Security audit
Security checks for vulnerabilities and agentic risk
This skill appears purpose-built for generating product videos, but it asks for credential handling and runtime installs in ways users should review carefully before installing.
Install only if you trust the qhkit/iqinghu service and are comfortable with local package installation, media uploads to a third-party service, and credit-consuming generation. Prefer configuring the API token through a local environment variable or secret store instead of pasting it into chat, and consider pinning npm package versions before use.
The text states that CLI messages are already user-facing Chinese and should be relayed directly, which imposes a language choice rather than offering the user's preferred language. This is a natural-language locale policy issue because the skill serves cross-border and international platforms but does not provide language choice or opt-in.
The description defines very broad trigger keywords covering generic video, marketing, and social-media terms, increasing the chance the skill activates for unrelated requests. Overbroad activation can route user prompts into unnecessary external-tool flows involving installation, API usage, and file handling, which expands attack surface and may override more appropriate safer skills.
The trigger section lacks clear boundaries and negative examples, so the skill may be selected whenever a user mentions Grok or product videos even if they did not intend this external service. In this skill's context, accidental activation is more risky because it can lead to package installation, remote API calls, and credential collection instructions.
The skill tells the agent to run npx @iqinghu/qhkit without pinning an exact version. That allows a future package update or package compromise to change executed code at runtime, creating a supply-chain risk in a workflow that explicitly installs and runs external tooling.
This duplicate finding points to the same persistent installation behavior: unpacking Node into a user-controlled persistent directory and updating PATH. Even with checksum verification, persistence remains a security concern because it alters the execution environment for future tasks and may survive beyond the user's awareness.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistent installation behavior: unpacking Node into a user-controlled persistent directory and updating PATH. Even with checksum verification, persistence remains a security concern because it alters the execution environment for future tasks and may survive beyond the user's awareness.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill explicitly instructs the agent to ask the user to send an API key in chat and then use it for configuration. Requesting secrets through ordinary conversation channels increases the chance of credential exposure in logs, transcripts, model context, or downstream systems, and the skill context makes this worse because the credential is for a third-party service that the agent will immediately configure and use.
The skill invokes npx --yes sharp-cli without an exact version, causing code from the latest published package to be fetched and executed on demand. Because this path is used during automated image handling, a malicious or compromised upstream release could lead to arbitrary code execution in the agent environment.