Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for translating ecommerce images through qhkit, with disclosed setup, upload, and credential requirements.
Install this only if you are comfortable using the @iqinghu/qhkit npm CLI, configuring a qhkit token, and sending selected images to the LinkPix/iqinghu service for processing. Prefer a pinned package version where possible, review any global install or shell PATH changes before applying them, and avoid submitting sensitive images unless the service terms fit your needs.
The description says the skill 'must trigger' whenever a user asks to translate image text or localize images into other languages, which covers many common requests and does not define boundaries for when this skill should not activate. Although some examples are domain-specific, the activation rule itself is broad and lacks negative examples or explicit scope constraints.
The skill recommends falling back to npx @iqinghu/qhkit <命令> ... without pinning an exact package version. That allows execution of whatever version the registry serves at runtime, increasing supply-chain risk and making behavior non-reproducible if a malicious or compromised release is published.
The duplicate finding points to the same persistence behavior: unpacking a runtime under the user's home directory and exporting a modified PATH, with guidance to add it to ~/.bashrc. In a skill context, this is more dangerous because the instructions normalize making durable workstation changes for a routine image-translation task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The duplicate finding points to the same persistence behavior: unpacking a runtime under the user's home directory and exporting a modified PATH, with guidance to add it to ~/.bashrc. In a skill context, this is more dangerous because the instructions normalize making durable workstation changes for a routine image-translation task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions require the skill to default to the China-site configuration and explicitly avoid guiding users toward the international site unless the user clearly states they use it. This imposes a locale/site policy choice in natural-language instructions rather than offering the user a neutral choice up front.