Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it asks the agent to install unpinned software and store an API key locally, so users should review it before installing.
Install only if you are comfortable letting the skill configure qhkit, install or update Node/npm tools, upload product images to the qhkit service, and store a qhkit API key locally. Prefer a pre-provisioned qhkit installation and a managed secret store instead of letting the agent install latest packages or persist tokens itself.
The manifest says the skill 'must trigger' whenever the user asks for JD product images, main images, detail images, or activity images. These are broad request categories that could overlap with ordinary conversation about e-commerce design work, and the file does not provide clear exclusion conditions or negative examples to constrain invocation.
The trigger examples include broad phrases like making JD product images, posters, or adapting platform sizing/layout, but do not clearly define when the skill should not activate. Without negative examples or stricter scope, these conditions may cause unintended invocation for general discussion or planning requests.
The skill goes beyond image generation and directs the agent to install Node.js, npm packages, and related tooling on the host, including downloading binaries and modifying PATH. Expanding a content-generation skill into environment bootstrap materially increases the attack surface and gives untrusted skill content a pathway to trigger software installation and code execution.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning a specific version, allowing whatever version is current on the registry to be fetched and run at execution time. That creates a supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could lead to arbitrary code execution on the host.
This duplicate finding identifies the same persistent installation behavior: extracting a Node runtime into a user-controlled directory and altering PATH for subsequent use. In the context of a product-image skill, that persistence is broader than necessary and makes the skill materially more dangerous because it can establish reusable host tooling outside the immediate task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same persistent installation behavior: extracting a Node runtime into a user-controlled directory and altering PATH for subsequent use. In the context of a product-image skill, that persistence is broader than necessary and makes the skill materially more dangerous because it can establish reusable host tooling outside the immediate task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to collect an API key from the user and persist it via qhkit config set --token <密钥> or environment variables. Persisting secrets locally broadens the skill from image generation into credential handling and creates risk of secret leakage, reuse by other processes, or retention beyond the user's intended session.
The skill tells the agent to run npx --yes sharp-cli without a pinned version during image processing fallback. This fetches and executes the latest published package on demand, exposing the environment to supply-chain compromise and unreviewed code execution outside the skill's primary purpose.
The instruction says to relay installation/configuration failures to the user and gives examples explicitly as Chinese user-facing messages, while the rest of the skill is also written to assume Chinese-language interaction. There is no indication that users can choose another language or locale, which may violate language-choice expectations.
The skill instructs the agent to locally transform user-supplied images using Python/Pillow or Node/sharp. While functionally related to image generation, this still expands the skill into host-side file processing with additional tooling, parsers, and executable dependencies that can introduce file handling and supply-chain risk.