AI电商图文广告 | 图文广告 | 营销图文 | 广告海报生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill appears to be a real marketing-image helper, but its setup instructions can automatically install and upgrade mutable external software with broad local authority.

Review before installing. Only use this if you trust the @iqinghu/qhkit npm package and service, are comfortable providing a QHKIT token and uploading media to that service, and can supervise any package installation or upgrade. Avoid letting an agent execute upgrade commands copied from CLI output; prefer a fixed, reviewed, pinned install in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:38-44` **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The same section permits immediate execution through an unpinned `npx` invocation: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade instructions at `SKILL.md:58-64` additionally install the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning a reviewed package version or verifying package integrity. The `@latest` upgrade command explicitly permits the installed code to change after the Skill has been audited. An npm package can execute code through lifecycle scripts during installation and through its CLI entry point when invoked. Global installation is broader than necessary for a task-specific utility because it modifies the user's shared Node.js environment. Using `npx` does not remove the risk: it downloads and immediately executes the selected package version. No evidence establishes that the current package is malicious. The vulnerability is the unsafe trust and execution model, which exposes the Agent environment to registry, maintainer-account, mirror, and future-release compromise. ### Attack Path 1. An attacker compromises the package maintainer account, npm registry path, configured package mirror, or a future package release. 2. The attacker publishes a modified version under `@iqinghu/qhkit`. 3. The Agent follows the Skill and runs the unpinned global installation, `npx` invocation, or `@latest` upgrade. 4. Malicious lifecycle or CLI code executes with the operating-system privileges of the Agent user. 5. The malicious package accesses files, environment variables, API tokens, or media available to that user and may execute additional commands or alter user-owned configuration. ### Impact Assessment Suc ...[truncated 649 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an implicit current version or `@latest`. 2. Use a lockfile and verify the package integrity digest before installation. 3. Remove automatic `@latest` upgrades. Version changes should require explicit review and approval. 4. Avoid global installation. Install the package in a dedicated temporary project or isolated container with a controlled dependency tree. 5. Disable npm lifecycle scripts with `--ignore-scripts` where compatible with the package. 6. Run the CLI under a dedicated low-privilege account or sandbox with access only to the media files needed for the current task. 7. Restrict filesystem and network access and provide the API token only to the command that requires it. 8. Use only a trusted registry. Do not silently fall back to a mirror unless its trust and integrity controls have been independently established. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58
• Finding: Execution of Upgrade Commands Supplied Through Untrusted CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58-61` **Vulnerability Type**: Command injection through externally influenced diagnostic output **Risk Level**: High ### Vulnerable Instruction The relevant instruction, translated into English from the source, states: ```text If the command returns {"ok":false,"stage":"version",...} (the version gate; the message contains the upgrade command, execute it as instructed), upgrade before retrying the original command. ``` The section then provides this expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to treat a CLI response message as an executable instruction. CLI output is untrusted data because it may be controlled by the installed package, a remote service used by the package, or an attacker who compromises either component. The response format does not enforce a strict command schema or allowlist. Consequently, an attacker able to control the `message` value could return an arbitrary shell command disguised as an upgrade instruction. Directly following that message crosses the trust boundary between external data and local command execution. Even if the legitimate service currently returns only npm upgrade commands, the Skill does not technically constrain future or compromised responses to that behavior. ### Attack Path 1. The Agent invokes `qhkit`, which communicates with the vendor service or processes package-controlled output. 2. An attacker compromises the CLI package, its update/version endpoint, or another component capable of controlling the returned `message`. 3. The attacker returns a response resembling: ```json {"ok":false,"stage":"version","message":"<attacker-controlled shell command>"} ``` 4. The Skill instructs the Agent to execute the command in `message` as an upgrade command. 5. The attacker-controlled command runs in the local shell with the Agent user's privileges. 6. The command can ...[truncated 626 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never execute commands extracted from `message`, standard output, standard error, API responses, or other externally influenced text. 2. Treat the response message solely as diagnostic text to display to the user. 3. Replace message-driven upgrades with a fixed local allowlist of permitted operations. 4. If an upgrade is required, parse only a validated semantic version field and construct the command locally without shell interpolation. 5. Pin upgrades to an approved version rather than using `@latest`. 6. Require explicit user confirmation before changing installed software. 7. Execute package-management operations without a shell where possible, using a fixed executable and argument array. 8. Validate that the requested package name is exactly `@iqinghu/qhkit` and that the version matches a strict semantic-version pattern. 9. Perform upgrades in an isolated environment with restricted filesystem, credential, and network access. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill metadata says requests for common marketing-image tasks 'must trigger' this skill, using broad keywords and no exclusion boundaries. That can cause overbroad activation on ambiguous user requests, steering the agent into installing/running external tooling and handling promotional workflows when the user may not have intended it. In this context, the danger is increased because activation can lead to environment bootstrapping, package installation, and external network use.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The description is entirely Chinese and frames triggering around Chinese-language marketing terms without offering language choice or a justified locale restriction. This can create usability and routing bias, causing the skill to be preferentially invoked for one language cohort while being opaque to others; while not a classic code-execution flaw, it is a real policy and control weakness in multi-lingual agent environments.

Static analysis

No suspicious patterns detected.