Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese video-generation workflow, but it requires installing CLI tooling, handling an API key, and spending service credits with user confirmation.
Install only if you are comfortable giving qhkit/青虎AI an API key, uploading the relevant media/prompts, and allowing npm-based tooling to be installed or updated. Confirm costs before generation, and prefer pinned or platform-managed dependencies where possible.
The manifest description says the skill must trigger on a long keyword list including broad terms like “抖音”, “快手”, “小红书”, “TikTok”, “YouTube Shorts”, and “投放素材”. These terms are common topic words rather than skill-specific invocation phrases, so they overlap with ordinary discussion and make the activation scope unclear.
The manifest description is entirely oriented around Chinese-language usage and later instructions require relaying messages to users in Chinese, but there is no indication that the user can choose another language. This creates a language policy concern because the skill appears to impose a locale/language expectation by default rather than offering user choice.
The markdown trigger guidance says to activate when the user names the model and provides a short-video link, but it does not clearly distinguish this skill from adjacent tasks like general analysis, script generation, or unrelated video operations. Without explicit non-trigger cases, users mentioning the model in a broader discussion could unintentionally invoke the skill.
The skill instructs use of npx @iqinghu/qhkit without a pinned version, which causes execution of whatever package version is current at runtime. This creates a supply-chain risk: a malicious or compromised upstream release could be fetched and executed automatically in the agent environment.
This duplicate finding points to the same persistence behavior: unpacking software into the user's home directory and instructing PATH changes. In skill context, this is more concerning because the skill is designed to self-bootstrap dependencies automatically, increasing the chance of unattended system modification.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking software into the user's home directory and instructing PATH changes. In skill context, this is more concerning because the skill is designed to self-bootstrap dependencies automatically, increasing the chance of unattended system modification.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instruction says CLI messages are already user-facing Chinese and should be relayed as-is, implying a fixed Chinese-language user experience. Because no opt-in or alternative language path is provided, this can violate language/locale policy expectations for broader audiences.
The skill directs the agent to run npx --yes sharp-cli without a pinned version during image compression fallback. That means a fresh package may be downloaded and executed on demand, exposing the environment to remote code execution via a compromised package or dependency update.
The file says failure messages are already Chinese and should be forwarded to the user, again enforcing a Chinese-only interaction pattern. This is a natural-language policy issue because it hardcodes a language choice rather than adapting to the user's preference.