AI电商图像生成 | 商品图生成 | 产品图 | 素材生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill is a coherent image-generation integration, but its install and upgrade instructions can run mutable npm packages and CLI-provided upgrade commands with the agent user's privileges.

Review before installing. This skill may install and update a global npm CLI, configure a service token, and upload prompts or selected image files to LinkPix. Prefer a pinned, reviewed qhkit version and do not execute upgrade commands copied from CLI output unless you have independently verified them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48-55 **Vulnerability Type**: Unpinned npm dependency and unsafe supply-chain execution **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also permit direct execution through: ```bash npx @iqinghu/qhkit <command> ... ``` The package is declared without an exact version: ```yaml metadata: {"openclaw":{"emoji":"🎨","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ### Technical Analysis The Skill installs or executes the mutable `@iqinghu/qhkit` npm package without pinning an audited version or verifying package integrity. Both the global installation and the `npx` fallback can retrieve whichever package version the selected registry currently resolves. An npm package can execute code through installation lifecycle scripts and through its command-line entry point. Consequently, compromise of the package publisher, npm account, registry infrastructure, or configured mirror could cause attacker-controlled code to execute during installation or use. The global installation scope is also broader than necessary. Although the document does not instruct the user to obtain root privileges and recommends `npx` after a permission failure, a global package can affect commands available across the Agent user's environment. ### Attack Path 1. An attacker compromises the `@iqinghu/qhkit` publisher account, release process, official registry record, or permitted mirror. 2. The attacker publishes or serves a malicious version under the legitimate package name. 3. The Skill detects that `qhkit` is unavailable and runs the unpinned global installation or `npx` command. 4. npm resolves the attacker-controlled version because no exact version or integrity value is required. 5. Malicious lifecycle or CLI code executes with the privileges of the account running the Agent. 6. The ma ...[truncated 654 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version instead of relying on the registry's current resolution. 2. Record and validate the package integrity hash through a lockfile or equivalent trusted manifest. 3. Prefer a project-local installation over `npm i -g` to limit environmental impact. 4. Avoid unpinned `npx` execution. If `npx` is required, specify an exact version and prevent implicit substitution with another release. 5. Use `npm ci` with a committed lockfile where feasible. 6. Disable npm lifecycle scripts with `--ignore-scripts` if the package functions without them. 7. Treat third-party mirrors as separate trust boundaries and require equivalent integrity verification. 8. Require explicit user approval before installing or changing executable dependencies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:70
• Finding: Execution of Upgrade Commands Supplied Through Untrusted CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 70-74 **Vulnerability Type**: Unvalidated command execution from tool-controlled output **Risk Level**: High ### Vulnerable Code Snippet The operative instruction, translated into English, states: ```text If the command returns {"ok":false,"stage":"version",...}, the upgrade command is contained in the message; execute it as instructed. ``` The document then provides the expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to treat the `message` field returned by the CLI as an executable instruction. It does not require the returned command to match a fixed allowlist, validate its arguments, or obtain user confirmation before execution. CLI output is untrusted data. It may be influenced by the installed package, a remote service contacted by that package, a compromised network endpoint, or a locally spoofed `qhkit` executable. Interpreting a returned message as a shell command creates a command-injection channel. The hard-coded example does not mitigate the issue because the preceding instruction explicitly says to execute the command contained in the returned message. A malicious response could substitute an unrelated shell command, an alternate package source, or additional shell operators. ### Attack Path 1. An attacker compromises or impersonates the `qhkit` executable, its package distribution, or a remote service that controls its version-gate response. 2. The attacker causes the CLI to return a response with `stage` set to `version`. 3. The response's `message` field contains an attacker-selected command instead of a legitimate upgrade instruction. 4. Following `SKILL.md`, the Agent extracts and executes that command without validating it against a fixed command template. 5. The injected command runs with the Agent user's privileges. 6. The attacker can then read or modify accessible files, obtain credential ...[truncated 644 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute commands contained in the CLI's `message` field. 2. Treat all stdout and stderr content as untrusted data intended only for display or structured status handling. 3. Define upgrade behavior as a fixed, locally controlled command with no arguments copied from CLI output. 4. Pin the upgrade target to an audited version rather than using `@latest`. 5. Validate that the executable path resolves to the expected trusted binary before invoking it. 6. Require explicit user approval before any dependency installation or upgrade. 7. Parse only documented structured fields and enforce a strict schema; never pass returned text to a shell. 8. If the tool reports an unsupported version, stop safely and report the condition rather than automatically executing a suggested command. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill metadata declares that image-generation requests 'must trigger' this skill using broad keywords and general request types, which can cause the agent to invoke it for a wide range of user intents beyond its narrowest safe scope. Overly mandatory and expansive routing language can crowd out more appropriate skills, increase unintended tool execution, and create opportunities for prompt/tool hijacking through generic image-related phrasing.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger section contains a catch-all rule covering other 'freeform generation/edit' needs not handled elsewhere, which is ambiguous and can absorb loosely related requests. This makes routing less predictable and can cause the skill to activate in cases where a more specialized or safer skill should be chosen, increasing the chance of unintended command execution and poor tool selection.

Static analysis

No suspicious patterns detected.