京东 商品图、主图套图、详情图、活动图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.1

Overview

The skill appears intended for JD product-image generation, but it asks agents to install mutable executable packages and handle API keys in ways users should review carefully.

Install only if you are comfortable with this skill downloading and running npm or Python packages and uploading selected product images to Qinghu AI. Configure API keys through a secure local secret mechanism rather than pasting them into chat, and prefer pinned, reviewed dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:54
• Finding: Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54-57`, `SKILL.md:80-83`, and `SKILL.md:93` **Vulnerability Type**: Unpinned executable dependencies and unsafe supply-chain sources **Risk Level**: High ### Complete Code Snippets ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit execution through `npx` and a third-party npm mirror: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` Image processing may install or execute additional unpinned packages: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i ORIGINAL_IMAGE -o COMPRESSED_IMAGE.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to download and execute mutable third-party packages without pinning exact versions or verifying package integrity. The global installation of `@iqinghu/qhkit` is especially sensitive because npm installation lifecycle scripts execute with the privileges of the invoking account and the resulting executable becomes available system-wide for that user or environment. Installing `@latest` guarantees that the effective executable can change after this Skill has been reviewed. Likewise, `npx --yes sharp-cli` automatically downloads and executes a package without an interactive trust decision. The Pillow installation uses a third-party Python package mirror rather than the canonical package index. These behaviors are broader than the minimum privileges required to generate an image. A safer implementation would use a preinstalled, reviewed CLI or an exact dependency version installed into an isolated environment. No evidence establishes that the named packages are currently malicious; the vulnerability is the mutable and insufficiently verified supply-chain execution path. The separate Node download at lines 62-63 is not a `curl | bash` execution chain. It downloads an archive a ...[truncated 1566 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every package to an exact reviewed version, including `@iqinghu/qhkit`, `sharp-cli`, and Pillow. 2. Remove `@latest` upgrades and require review before changing dependency versions. 3. Use lockfiles and verify registry-provided integrity metadata or independently published cryptographic hashes. 4. Prefer official registries. Do not silently fall back to third-party mirrors; require explicit user approval and document the trust implications. 5. Install dependencies into an isolated project directory, virtual environment, or disposable container instead of using global installation. 6. Disable package lifecycle scripts where feasible, for example with `npm install --ignore-scripts`, after confirming that the package operates correctly without them. 7. Replace `npx --yes` with a pinned, locally installed executable. 8. Require explicit user confirmation before downloading or installing executable software. 9. Run image-processing tools in a sandbox with restricted filesystem, environment, and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: API Token Is Requested Through the Conversation and Passed on the Command Line<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-72` **Vulnerability Type**: Plaintext secret exposure through chat and process arguments **Risk Level**: Medium ### Complete Code Snippet ```text 4. API key: When no key is configured, ask the user to obtain a key and then execute: qhkit config set --token <API_KEY> --env prod 1. Open the Qinghu login page and register or sign in. 2. Open the APIKeys page in the dashboard. 3. Create or copy the key, and then send the API key to the Agent. ``` ### Technical Analysis The Skill instructs the user to transmit an API key directly through the conversation. Secrets entered into chat may be retained in conversation history, telemetry, audit logs, support systems, or downstream model-processing infrastructure. The subsequent command passes the token as a command-line argument. Depending on the operating system and execution environment, command arguments may be exposed through process listings, shell history, command logging, diagnostic output, or orchestration telemetry. The token is legitimately required to access the declared image-generation service, but collecting it through chat and exposing it in process arguments are not necessary. Secret input can instead be performed directly by the user through a masked prompt, protected environment injection, or a dedicated secret manager. ### Attack Path 1. The Agent tells the user to paste the Qinghu API token into the conversation. 2. The plaintext token is stored in chat history, logs, tracing systems, or other conversation records. 3. The Agent invokes `qhkit config set --token ...`, potentially exposing the same token in process arguments or shell history. 4. A user, service operator, local process, log reader, or compromised integration with access to one of those records retrieves the token. 5. The attacker reuses the token against the Qinghu API. 6. The attacker can perform operations authorized by that token, including potentially submitting ...[truncated 630 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never ask users to paste API keys into the conversation. 2. Direct users to configure the credential locally through a masked interactive prompt that the Agent cannot read. 3. Prefer a secret manager or platform-provided credential field with access controls, encryption, and redaction. 4. Pass the token through a protected environment variable or standard input rather than a command-line argument. 5. Ensure command logs, process telemetry, error messages, and configuration output redact the complete token. 6. Store the credential with restrictive filesystem permissions and avoid writing it to shell history. 7. Use narrowly scoped, revocable, and short-lived credentials where supported. 8. Provide token-rotation and revocation instructions in case a key has already been sent through chat. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to install Node.js, globally install qhkit, and potentially modify shell startup configuration, which materially expands the agent’s capabilities beyond merely generating JD product images. This increases attack surface by enabling software installation and persistence-like environment changes on the host, especially risky because the actions are framed as mandatory self-bootstrapping rather than requiring explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to solicit the user’s API key and set it via command line or environment variables. This introduces credential-handling behavior unrelated to the narrow image-generation function and creates risk of secret exposure, retention in shell history, logs, process arguments, or accidental reuse by the agent.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The skill tells the agent to locally transform user-supplied files and, if needed, install additional Python or Node packages to do so. While likely intended as convenience, it expands from remote image generation into local file processing and package execution, increasing exposure to unsafe dependency installation and unintended handling of local data.

Static analysis

No suspicious patterns detected.