HappyHorse 1.1 电商带货视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill is aligned with video generation, but it needs review because it asks users to share an API key in chat and directs agents to install or upgrade unpinned executable packages.

Review before installing. Prefer a pinned, isolated qhkit install, avoid sending API keys in chat, configure credentials through a protected local secret mechanism where possible, and confirm exactly which files will be uploaded and what credits will be spent before generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51
• Finding: Unpinned Third-Party Packages Are Installed and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-54`, `SKILL.md:78-81`, and `SKILL.md:91` **Vulnerability Type**: Unpinned dependency installation and supply-chain code execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The image-processing fallback also directs the Agent to install or execute additional unpinned packages: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli ``` ### Technical Analysis The Skill instructs the Agent to retrieve and execute third-party packages without pinning reviewed versions or package integrity hashes. In particular, `@latest` explicitly selects whichever package release is current when the command runs. The effective executable code can therefore change after the Skill itself has been reviewed. Global npm installation may execute package lifecycle scripts and places executables in a shared user or system-level npm prefix. The `npx --yes` fallback downloads and executes a package without interactive confirmation. The instructions also permit alternative npm and Python mirrors, increasing the number of supply-chain systems that must be trusted. This behavior is related to the declared functionality because the Skill requires the `qhkit` client. However, automatic global installation, automatic upgrades to `@latest`, and execution of unpinned auxiliary packages exceed the minimum-risk installation strategy. A project-local, version-pinned, integrity-verified installation would provide the necessary functionality with less exposure. The separately flagged checksum pipeline at `SKILL.md:60` is not a `curl | bash` execution: ```bash curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It passes a checksum record to `sha256sum`, not executable shell code, and the archive is extracted only after verification. Consequ ...[truncated 1530 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every executable dependency to a reviewed exact version rather than using an implicit current version or `@latest`. 2. Use lockfiles and registry-supported integrity metadata. Where practical, independently record and verify expected package hashes. 3. Install packages in an isolated project directory or disposable container instead of globally. 4. Disable unnecessary npm lifecycle scripts during installation and review any lifecycle scripts required by the package before enabling them. 5. Replace automatic `npx --yes` execution with a pinned, preinstalled tool or an explicitly approved local dependency. 6. Avoid automatically switching to third-party mirrors. If a mirror is necessary, use an approved mirror with equivalent integrity verification and document its trust assumptions. 7. Require explicit user approval before installing or upgrading executable dependencies. 8. Run media-processing and CLI dependencies in a sandbox with limited filesystem access, restricted network access, and only the credentials required for the current operation. 9. Maintain a reviewed version allowlist and update it through a controlled security review rather than executing upgrade commands supplied dynamically by package output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67
• Finding: API Key Is Requested Through Chat and Passed in a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-73` **Vulnerability Type**: Insecure secret collection and handling **Risk Level**: Medium ### Vulnerable Code The Skill instructs the user to send the API key to the Agent and then configure it using this command pattern: ```bash qhkit config set --token <API_KEY> --env prod ``` It mentions `QHKIT_TOKEN` as an alternative, but does not make a protected secret-entry mechanism the required or preferred workflow. ### Technical Analysis Requesting a raw API key in a conversation causes the credential to enter the chat and Agent processing pipeline. Depending on the hosting environment, the secret may be retained in conversation history, telemetry, audit logs, tool-call records, debugging traces, or exported transcripts. Passing the key through `--token` additionally places it in a process argument. Command-line arguments may be visible in shell history, process inspection tools, execution logs, or orchestration metadata. Although the CLI may ultimately store the token securely, the Skill does not establish secure transport, redaction, file permissions, retention limits, or deletion of intermediate records. Authentication is necessary for the declared remote video-generation service, but disclosure of the raw key to the Agent is not the least-privilege approach. The user can configure the credential directly through a protected local prompt or secret manager without exposing it to the conversation. ### Attack Path 1. The user follows the Skill's instructions and sends the API key in the chat. 2. The key is incorporated into conversation history or a tool command. 3. The conversation, command, process argument, shell history, telemetry, or execution log retains the plaintext secret. 4. A person or service with access to one of those records retrieves the key. 5. The exposed credential is used to access Qinghu API functionality, consume account credits, submit tasks, or access any resources a ...[truncated 807 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction asking users to send API keys through chat. 2. Require users to configure the token directly in their own environment using a hidden interactive prompt, operating-system keychain, or approved secret manager. 3. Avoid placing secrets in command-line arguments. Read the token from a protected file descriptor, hidden prompt, or injected secret variable that is not logged. 4. If an environment variable is used, ensure the orchestration platform marks it as secret, prevents telemetry capture, and limits it to the single process that requires it. 5. Redact tokens from stdout, stderr, tool calls, exception messages, and diagnostic output. 6. Store persistent credentials with restrictive file permissions and clearly document the storage location and security model. 7. Recommend narrowly scoped, short-lived API keys with spending limits where the service supports them. 8. Provide explicit key rotation and revocation instructions for suspected exposure. 9. Add automated checks preventing credentials from being included in generated command strings or conversation responses. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger terms are very broad and include common e-commerce/video words such as product display, seeding, Taobao, Douyin, and TikTok, which can cause the skill to activate for many unrelated requests. That increases the chance of unintended tool execution, unnecessary third-party data exposure, and user confusion about why this specific external service was invoked.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation section relies on examples and broad phrasing rather than strict boundaries, so an agent may match loosely related requests for ads or product videos even when the user did not ask for this vendor-specific skill. In this skill's context, that is more dangerous because the workflow includes installing software, uploading local media, polling remote jobs, and potentially consuming credits.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: The contract instructs the agent to relay messages and guidance in Chinese, including fixed Chinese-language user-facing text, without checking the user's language preference. While not a direct code-execution issue, this can impair informed consent around billing, API key handling, and external uploads if the user cannot clearly understand the warnings or confirmation details.

Static analysis

No suspicious patterns detected.