商品图消除 | 去水印 | 去除杂物 | 智能擦除 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill’s image-erasing purpose is clear, but its install and upgrade instructions allow mutable external command execution that users should review before installing.

Install only if you trust the @iqinghu/qhkit npm package and LinkPix service. Prefer a pinned reviewed qhkit version in an isolated environment, do not run upgrade commands copied from tool output without checking them, and avoid giving the skill sensitive images or tokens beyond what the task requires.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42
• Finding: Unpinned npm Dependency Installation and Automatic Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-45, 60-63` **Vulnerability Type**: Untrusted and unpinned third-party executable dependency **Risk Level**: High ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The documented fallback uses: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure uses: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes the `@iqinghu/qhkit` npm package without pinning it to a reviewed version or integrity digest. The fallback through `npx` can also download and execute the package dynamically. The upgrade procedure explicitly requests the mutable `latest` release. Consequently, the code executed by this Skill can change after the Skill itself has been audited. npm package lifecycle hooks and the installed CLI execute with the permissions of the account running npm. A malicious package release, compromised maintainer account, registry compromise, or upstream dependency compromise could therefore result in arbitrary local code execution. Global installation unnecessarily increases the package's reach within the user environment compared with a project-local, pinned installation. The instructions do not explicitly require root access, so this issue does not independently establish privilege escalation; its normal scope is the current user's privileges. ### Attack Path 1. An attacker compromises the package publisher, npm account, package distribution channel, or a transitive dependency. 2. The attacker publishes a malicious version under the legitimate `@iqinghu/qhkit` package name. 3. The Agent encounters a missing CLI, permission-related fallback, or upgrade condition. 4. The Agent runs the unpinned `npm`, `npx`, or `@latest` command. 5. npm downloads the attacker-controlled release. 6. Malicious lifecycle hooks or CLI code execute with the invoking user's permissions. 7. The payload can access files, credentials, environment varia ...[truncated 875 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed version rather than using an implicit current version or `@latest`: ```bash npm install --global @iqinghu/qhkit@EXACT_REVIEWED_VERSION ``` 2. Verify the package archive against an independently recorded integrity digest before execution. 3. Remove instructions that automatically install `@latest`. 4. Do not use `npx` in a way that implicitly downloads unreviewed code. If `npx` is retained, require an exact version and disable installation when the package is absent. 5. Prefer a project-local or isolated installation over a global installation. 6. Require explicit user approval before installing or upgrading executable dependencies. 7. Review the package, its lifecycle scripts, and its transitive dependency lockfile before approving a new version. 8. Run the CLI in a restricted environment with access limited to the intended input image and required network endpoints. 9. Document the approved package version and update it only through a controlled review process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60
• Finding: Execution of Upgrade Commands Supplied Through Remote-Controlled CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:60` **Vulnerability Type**: Command injection through trusted service or CLI output **Risk Level**: High ### Complete Code Snippet The instruction at line 60 states, in English: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; follow it directly. ``` ### Technical Analysis The Skill instructs the Agent to treat the `message` field returned by the CLI as an executable command and to follow it directly. That field crosses a trust boundary: it can be influenced by the installed CLI and potentially by its remote backend. No command allowlist, syntax validation, argument validation, signature verification, or user confirmation is required before execution. If either the package or backend response is compromised, shell metacharacters or an entirely unrelated command could be placed in `message`. An Agent following the Skill instructions could then execute that content locally. A diagnostic message should be handled as untrusted data and displayed to the user, not interpreted as executable instructions. The Skill already defines a fixed npm upgrade operation elsewhere, so executing arbitrary returned command text is unnecessary for its declared image-processing functionality. ### Attack Path 1. An attacker compromises the `qhkit` package, its update service, its backend, or a network endpoint trusted by the CLI. 2. The compromised component returns a response with `stage` set to `version`. 3. The response places an attacker-selected shell command in the `message` field. 4. The Skill directs the Agent to follow that command directly. 5. The Agent invokes a shell or another execution tool with the attacker-controlled content. 6. The command executes with the Agent process's current user permissions. For example, the malicious response could direct the Agent to download another payload, disclose environment variables, overwrite user files ...[truncated 882 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute any command contained in the returned `message`. 2. Treat all CLI and service output as untrusted data. 3. Display diagnostic messages to the user only after safe escaping; never pass them to a shell. 4. Use a locally defined, fixed upgrade command with an exact approved version. 5. Permit upgrades only when `stage` exactly matches an expected value and after explicit user confirmation. 6. Implement an allowlist of permitted executable names and arguments if automated maintenance is unavoidable. 7. Invoke programs through structured argument arrays rather than shell command strings. 8. Reject shell metacharacters, command substitutions, redirections, and additional commands in any remotely derived value. 9. Cryptographically authenticate update metadata and verify package integrity before installation. 10. Run update operations under a non-privileged account in an isolated environment. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description uses very broad natural-language triggers such as '去水印、去文字、去杂物、擦除、清理图片', plus '必须触发', which can match many ordinary image-editing requests without clear boundaries. This can cause unintended invocation of the skill, especially when a user only loosely describes cleaning or editing an image, leading to over-activation and potentially routing users into watermark-removal behavior that may have policy or misuse implications.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The invocation examples are short and generic ('把图里的水印/文字/路人/杂物去掉', '清理一下这张图，只留商品') and do not define trigger boundaries or disambiguate from adjacent skills like text replacement, generic retouching, or video editing. This increases the chance of accidental or overly broad activation, though the impact is somewhat reduced by later boundary notes in the skill.

Static analysis

No suspicious patterns detected.