电商图文字修改 | 图片改字 | 替换文字 | 修改价格文字 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

This image text-editing skill matches its stated purpose, but it gives a third-party CLI too much unsupervised install and update authority for a normal image-edit workflow.

Review this skill before installing. Use it only if you trust the qhkit package and LinkPix service, avoid running upgrade commands copied from tool output, prefer a pinned/local install where possible, and treat the API token as sensitive. Be aware that image files may be uploaded to the service and credits may be consumed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42-63 **Vulnerability Type**: Unpinned and automatically upgraded npm dependency **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The instructions install and execute `@iqinghu/qhkit` without pinning it to an audited version or package integrity hash. The explicit `@latest` upgrade further allows package contents to change after this Skill has been reviewed. npm packages can contain executable lifecycle scripts, and the installed CLI itself runs arbitrary package code. The package therefore receives the privileges of the user running npm or `npx`. The optional fallback to a third-party npm mirror also expands the supply-chain trust boundary. This dependency is relevant to the declared image-editing function, but automatically installing an unpinned package is not the minimum-risk way to provide that function. The Skill should use a reviewed, immutable dependency version and obtain approval before changing installed software. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, a release process, or a configured registry response. 2. The attacker publishes a malicious version under the expected package name or version channel. 3. The Agent follows the Skill instructions and runs the unpinned global installation, `npx`, or `@latest` upgrade. 4. npm executes malicious lifecycle code or installs the malicious CLI. 5. The package executes with the Agent user's privileges and can access resources available to that account. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the account running npm. This can expose local files, environment variables, API credentials, image inputs, and other data available to the Agent. A global installation may also modify the user's npm ...[truncated 296 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specific, reviewed version instead of using a bare package reference or `@latest`. - Verify the package with an independently maintained integrity hash, lockfile, or signed provenance information. - Remove the instruction to execute upgrades supplied dynamically by version channels. - Require explicit user approval before installing or upgrading software. - Prefer execution in a restricted environment with minimal filesystem and credential access. - Avoid global installation when a project-local, locked dependency is sufficient. - Disable npm lifecycle scripts where compatible, such as with `--ignore-scripts`, and separately review any required installation scripts. - Treat alternate registries as separate trust boundaries and require equivalent integrity verification. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:60
• Finding: Execution of Commands Supplied Through External CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Externally controlled command execution **Risk Level**: High ### Vulnerable Instruction ```text If the command returns a version-stage error, the message contains the upgrade command; execute it directly. ``` The snippet above is an English normalization of the instruction at the cited location. ### Technical Analysis The Skill instructs the Agent to execute an upgrade command taken directly from the CLI's `message` field. That field can be influenced by the installed CLI or its remote backend. It is data from an external trust boundary and is not constrained to a fixed command, validated against an allowlist, or presented only as non-executable information. Treating response text as shell instructions creates a command-injection channel. Although the expected response is an npm upgrade command, a compromised CLI or service could return any command supported by the local shell. This behavior exceeds the privileges needed for image editing. A version error only requires reporting the problem or selecting a predefined, locally reviewed upgrade procedure; it does not require executing arbitrary response content. ### Attack Path 1. An attacker compromises the `qhkit` package, its service backend, its network-facing response path, or another component capable of controlling the returned JSON. 2. The attacker causes the CLI to return `stage:"version"` with a malicious shell command in the `message` field. 3. The Agent follows the Skill instruction to execute the command directly. 4. The shell runs the attacker-controlled command with the Agent user's privileges. 5. The attacker can then read or modify accessible data, invoke other programs, or retrieve additional payloads. ### Impact Assessment Exploitation can result in arbitrary shell command execution as the account running the Agent. Accessible scope may include local project files, user files, environment ...[truncated 335 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never execute commands extracted from CLI output, error messages, API responses, or other externally controlled text. - Replace dynamic execution with a fixed, locally authored command that pins an approved package version. - Validate version information as structured data rather than interpreting a message as shell syntax. - Allow only explicitly supported version transitions through a strict allowlist. - Require informed user approval before any package installation or upgrade. - Display unexpected response content as untrusted diagnostic text only. - Run update operations in a sandbox with restricted filesystem, credential, and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: API Token Exposed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Insecure secret handling **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <API_TOKEN> --env prod ``` The token metavariable has been normalized to English; the command structure is unchanged. ### Technical Analysis The configuration instruction places the API token directly in a command-line argument. Secrets supplied this way may be recorded in shell history, terminal transcripts, Agent execution logs, process-monitoring systems, audit telemetry, or diagnostic output. Depending on the operating system and process configuration, another local process or user may also be able to inspect command-line arguments while the command is running. The Skill mentions the `QHKIT_TOKEN` environment variable as an alternative, but environment variables can also leak through process environments and logs. Neither mechanism is as safe as a protected standard-input channel, a no-echo interactive prompt, or an operating-system secret store. ### Attack Path 1. A user obtains an API token and substitutes it into the documented command. 2. The Agent or shell executes the command with the plaintext token in its argument list. 3. The command is retained in shell history, an Agent transcript, telemetry, or process inspection output. 4. A local attacker or unauthorized log reader retrieves the token. 5. The attacker uses the token to invoke the associated service and consume account resources or access data permitted by the token. ### Impact Assessment Exposure can permit unauthorized use of the LinkPix service under the victim's account, including consumption of credits and access to any API capabilities granted to that token. The exact server-side scope cannot be determined from the project. This issue does not establish system-level privilege escalation, but it exposes a reusable credential outside the minimum scope necessary for a one-time configura ...[truncated 19 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Accept the token through a no-echo interactive prompt or protected standard input rather than a command-line argument. - Store the token using an operating-system credential manager or a permission-restricted configuration file. - Ensure any token file is readable only by its owner. - Prevent secrets from being written to shell history, Agent transcripts, telemetry, and debug logs. - Redact token values from all command output and error messages. - If environment variables must be supported, document their exposure risks and unset them immediately after use. - Support token rotation and revocation so accidentally exposed credentials can be invalidated promptly. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill metadata says image text-edit requests '必须触发' and lists very broad keywords, which can cause the agent to invoke this skill on many common user requests without sufficient intent validation. Because the skill performs external CLI-based generation/editing and may install dependencies, unintended invocation can lead to unnecessary external calls, unexpected modifications, and user-surprising behavior.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The skill instructs the agent to relay CLI messages in Chinese and the overall behavior is strongly Chinese-default, which can override the user's language preference if they are interacting in another language. This is primarily a safety and usability issue: users may misunderstand installation, billing, or failure information, increasing the chance of incorrect consent or operational mistakes.

Static analysis

No suspicious patterns detected.