Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned for generating ecommerce videos, but it asks the agent to install runtime tools and handle API keys in ways users should review before installing.
Install only if you are comfortable with the agent modifying your local Node/npm environment and configuring qhkit credentials. Prefer manually installing pinned tool versions and setting the API key yourself through a secure local secret mechanism rather than pasting the key into chat.
The description says the skill must trigger for broad terms such as '产品展示', '种草', '短剧', platform names like '淘宝' and '抖音', and generic 'AIGC视频生成'. These phrases are common in ordinary user requests and are not narrowly scoped to this specific skill, which could cause unintended invocation.
The '何时触发' section includes one quoted phrase but also a vague condition: '用户点名该模型出电商展示片、主图视频、信息流广告视频'. It does not clearly define boundaries or negative examples for similar requests that should route elsewhere, increasing the chance of overlap with adjacent video-generation skills.
The skill goes far beyond invoking a video-generation tool and instructs the agent to install Node.js, globally install packages, fetch binaries, modify PATH, and install auxiliary tooling like Pillow or sharp. Expanding the agent's authority to perform general environment bootstrap materially increases the attack surface and turns a media-generation skill into one that can alter the local system state.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version. That causes execution of whatever package version is current at runtime, which weakens supply-chain integrity and can introduce unexpected code changes or malicious updates into the agent environment.
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and exporting it into PATH. Even though the example validates the archive checksum, the action still establishes ongoing runtime state and broadens the agent's effective privileges and future execution surface.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and exporting it into PATH. Even though the example validates the archive checksum, the action still establishes ongoing runtime state and broadens the agent's effective privileges and future execution surface.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill explicitly tells the agent to ask the user for an API key and then set it locally with qhkit config set --token <密钥>. Having the agent collect and handle raw credentials is dangerous because it expands secret exposure, enables accidental retention in logs or chat history, and is not strictly necessary when users can configure credentials directly.
The embedded user guidance instructs the agent to send a fixed Chinese onboarding message to users for obtaining keys. This is a language policy concern because it assumes Chinese output rather than offering language choice or conditioning on the user's preferred locale.
The skill recommends npx --yes sharp-cli without a pinned version, which permits retrieval and execution of the latest package at invocation time. This creates avoidable supply-chain risk, especially because the package is used automatically as a fallback during image processing rather than through explicit user review.