ClawHub
Back to skill

Security audit

电商图文字修改 | 图片改字 | 替换文字 | 修改价格文字 | LinkPix

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently supports image text editing through the disclosed qhkit CLI, with ordinary but notable dependency-install and API-token setup considerations.

Before installing, confirm you are comfortable installing or updating the qhkit npm package, possibly installing Node locally, and providing a qhkit API token. Images you process and prompts will be sent to the qhkit/iqinghu service, so use appropriate material and verify generated prices or text before publishing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L03 says the skill 'must trigger' whenever a user asks to change text, price, title, or promotional information in an image, and includes broad keywords like '改文字', '换文案', and '修改标题'. These phrases are common in ordinary image-editing requests and the file does not provide exclusion conditions or negative examples to distinguish this skill from adjacent skills such as translation or watermark removal.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs falling back to npx @iqinghu/qhkit <命令> ... without pinning a specific version. That allows execution of whatever package version is current at invocation time, which creates supply-chain and reproducibility risk if a malicious or breaking release is published.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

This duplicate finding points to the same behavior: unpacking Node into a user-owned directory and instructing persistent PATH modification. Even with checksum verification, the persistence aspect changes the user's environment in a way that survives the immediate task and broadens the blast radius of any later misuse or conflicts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

This duplicate finding points to the same behavior: unpacking Node into a user-owned directory and instructing persistent PATH modification. Even with checksum verification, the persistence aspect changes the user's environment in a way that survives the immediate task and broadens the blast radius of any later misuse or conflicts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

L59 instructs operators not to guide users using the international site and to provide domestic-site key instructions, while the surrounding operational text assumes Chinese-language interaction and says CLI messages are user-facing Chinese. The file does not offer a user language or locale choice, which can violate language/locale policy when used with users who did not opt into Chinese-only guidance.

Content

No source excerpt is available for this finding.