电商图裂变 | 图片裂变 | 多版本生成 | 广告素材裂变 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill’s image-generation purpose is coherent, but its setup instructions give too much trust to an unpinned third-party CLI and external upgrade messages.

Install only if you are comfortable running the qhkit npm package with your account permissions. Prefer a pinned, reviewed version in an isolated environment, do not blindly execute upgrade commands printed by the CLI, and only provide image files and QHKIT_TOKEN values needed for the current job.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:45
• Finding: Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45-48 and 66 **Vulnerability Type**: Unpinned npm dependency with global installation and direct execution **Risk Level**: High ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The documented fallback directly executes the package through: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure additionally installs the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs or executes `@iqinghu/qhkit` without pinning an audited version or package integrity value. Both the implicit current version and the `@latest` tag can resolve to code published after the Skill was reviewed. npm packages can execute code through lifecycle scripts during installation and through their command-line entry points at runtime. A global installation broadens the effect because it modifies the user-wide Node.js environment instead of an isolated project directory. The `npx` fallback also retrieves and executes the package directly when it is not already installed. This dependency is necessary for the declared image-generation functionality, but global, unpinned installation exceeds the minimum safe installation scope. The secondary registry fallback also adds another supply-chain distribution point, although the reviewed text identifies it as a mirror rather than an unrelated package source. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, the publishing pipeline, or an accepted registry distribution path. 2. The attacker publishes a malicious release under the expected package name or causes the unpinned resolution to return compromised content. 3. The Agent follows the Skill instructions and runs `npm i -g @iqinghu/qhkit`, `npm i -g @iqinghu/qhkit@latest`, or `npx @iqinghu/qhkit`. 4. npm lifecycle code or the CLI entry point executes with the permissions of the Agent account. 5. The mal ...[truncated 812 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an implicit version or `@latest`. 2. Record and validate the package integrity hash using a lockfile or equivalent trusted manifest. 3. Remove the instruction to install `@latest` automatically. Upgrades should require explicit review and approval. 4. Install the dependency in an isolated, non-global project directory or disposable container. 5. Run the CLI as a dedicated unprivileged account with access only to the images selected for upload. 6. Disable npm lifecycle scripts where compatible, for example by using `--ignore-scripts`, and separately review any required installation scripts. 7. Restrict the CLI's filesystem and network access through sandboxing or container policy. 8. Treat registry mirrors as separate trust boundaries and verify that retrieved package integrity matches the approved manifest. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:64
• Finding: Execution of Upgrade Commands Derived from External CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64-66 **Vulnerability Type**: Unvalidated command execution based on externally influenced CLI output **Risk Level**: High ### Vulnerable Code Snippet English rendering of the relevant instruction: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it exactly. ``` The accompanying predefined upgrade example is: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to treat text in a CLI response's `message` field as an executable upgrade command and to follow it exactly. Data emitted by an external CLI must not be treated as trusted shell instructions. The output could be influenced by a compromised package, a compromised backend service, or maliciously modified local tooling. Without parsing the response against a strict allowlist, the `message` field could contain arbitrary shell syntax rather than a legitimate package-upgrade command. This creates a command-execution boundary violation: externally controlled data is promoted into Agent instructions. Merely displaying the message would be safe, but executing it is not necessary for the declared image-generation function and exceeds minimum privilege and trust requirements. ### Attack Path 1. An attacker compromises the installed CLI, its update-check mechanism, or a backend response used to produce the version error. 2. The attacker causes the CLI to return a response with `stage:"version"` and places an arbitrary command in the `message` field. 3. The Skill directs the Agent to execute the supplied command exactly. 4. The Agent passes the attacker-controlled command to a shell or equivalent execution tool. 5. The command executes with the Agent account's permissions and can access files, credentials, and network resources. ### Impact Assessment Exploitation can result in arbitrary command execution under the Agent's ope ...[truncated 523 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute commands contained in a CLI `message` field. 2. Treat all CLI and service output as untrusted data suitable only for display or structured parsing. 3. Implement a fixed allowlist of permitted upgrade operations. Do not permit shell metacharacters, arbitrary arguments, URLs, or alternate package names. 4. Replace dynamic upgrade instructions with a hard-coded command that installs an exact reviewed version. 5. Require explicit user confirmation before any package installation or upgrade. 6. Execute package-management operations in an isolated, unprivileged environment. 7. Verify package integrity and provenance before installation. 8. Log the requested upgrade, resolved package version, registry, and integrity value for later review. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.