可灵 Kling 3.0 电商带货视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.1

Overview

The skill is for generating ecommerce videos, but it asks the agent to install global tools and handle a raw API key, so users should review it before installing.

Install only if you are comfortable with the agent setting up qhkit and processing/uploading your product media. Do not paste a real API key into chat; configure it through a trusted local secret mechanism if possible. Prefer a pinned, preinstalled qhkit runtime rather than letting the skill perform global installs or @latest upgrades during use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51
• Finding: Unpinned Third-Party Packages Are Installed and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 51, 77, and 90 **Vulnerability Type**: Unsafe runtime dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit npm i -g @iqinghu/qhkit@latest pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` The surrounding instructions also permit npm mirror substitution: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the Agent to download and execute third-party packages dynamically without pinning exact versions or verifying package integrity. The use of `@latest` explicitly causes the executed package contents to vary over time. Similarly, `npx --yes sharp-cli` downloads and executes a package without interactive review. The Python fallback installs Pillow from an alternate package index without a pinned version or hash. Global installation of `@iqinghu/qhkit` broadens the potential effect beyond the immediate task. npm lifecycle scripts and installed executables run with the privileges of the Agent's operating-system account and may access files, environment variables, API credentials, and network resources available to that account. Although no malicious dependency is included directly in the audited project, this design creates a supply-chain execution channel whose payload can change after the Skill has been reviewed. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, a package maintainer account, or a permitted package registry. 2. The attacker publishes a malicious version under the expected package name or causes the registry to serve manipulated package content. 3. The Agent follows the Skill's installation or upgrade instructions. 4. `npm`, `npx`, or `pip` downloads the compromised package. 5. Package installation hooks or the down ...[truncated 983 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version rather than using unversioned packages or `@latest`. 2. Verify downloaded package integrity using a trusted lockfile, registry integrity metadata, or independently distributed cryptographic hashes. 3. Replace `npx --yes` with a locally installed, pinned dependency whose integrity has already been verified. 4. Avoid global installation. Install dependencies in a dedicated project directory, container, virtual environment, or other isolated runtime. 5. Do not automatically switch registries. If a mirror is necessary, require explicit user approval and document its trust implications. 6. Disable package lifecycle scripts where feasible, for example with `npm install --ignore-scripts`, after confirming that the reviewed package does not require them. 7. Run third-party tools with minimum filesystem and network permissions and without unrelated credentials in their environment. 8. Require explicit user approval before installing or upgrading executable dependencies. 9. Prefer a prebuilt, reviewed runtime image with fixed dependency versions over runtime bootstrapping. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: API Credentials Are Requested Through the Conversation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–71 **Vulnerability Type**: Insecure handling of plaintext API credentials **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <API_KEY> --env prod ``` The surrounding instructions tell the user to create or copy an API key and then send that key to the Agent. They alternatively permit configuration through the `QHKIT_TOKEN` environment variable. ### Technical Analysis Requesting an API key through a chat conversation exposes the credential to every system that stores, processes, monitors, or can retrieve the conversation. Potential exposure points include transcript retention, telemetry, debugging logs, integrations, prompt history, and other components with access to the Agent context. Passing the key as a command-line argument can create additional exposure. Depending on the operating system and execution environment, command arguments may be visible in process listings, shell history, audit records, or tool logs. No deliberate credential-exfiltration endpoint was found in the Skill. Nevertheless, the prescribed workflow unnecessarily moves a sensitive secret through plaintext channels rather than using a secure local secret-entry mechanism. ### Attack Path 1. The user follows the Skill's instructions and pastes an active Qinghu API key into the conversation. 2. The key becomes part of the conversation transcript or associated operational logs. 3. A person, integration, extension, or compromised component with access to those records retrieves the key. 4. The exposed key is used to authenticate to the Qinghu service. 5. The attacker submits API requests, consumes account credits, or accesses resources authorized to that key until it is revoked or expires. A secondary path exists when the key is passed directly on the command line: 1. The Agent executes `qhkit config set --token <API_KEY> --env prod`. 2. The complete command is retained in shell history ...[truncated 720 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never ask users to paste API keys into a conversation. 2. Direct users to configure `QHKIT_TOKEN` locally through a trusted secret manager or a private execution-environment settings interface. 3. Provide an interactive terminal command that reads the key without echoing it, rather than accepting it as a command-line argument. 4. Ensure the token is not written to shell history, stdout, stderr, telemetry, or Agent tool logs. 5. Store credentials in an operating-system credential store or a configuration file with permissions restricted to the owning user. 6. Redact token-like values from all command output and error messages. 7. Use narrowly scoped and short-lived API credentials where supported. 8. Document token revocation and rotation procedures for accidental exposure. 9. If a token has already been pasted into a conversation, advise the user to revoke it immediately and create a replacement through a secure channel. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to bootstrap a broader runtime environment by downloading Node.js, modifying PATH, and globally installing/upgrading qhkit. That exceeds the narrow task of generating an e-commerce video and expands the attack surface through network downloads, package installation, and persistent system changes. In skill context this is somewhat understandable for tool enablement, but it is still risky because the skill treats environment modification as routine rather than requiring explicit user approval and least-privilege execution.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to ask the user for an API key and then set it via a CLI command or environment variable, creating a path for the agent to handle long-lived credentials directly. This is dangerous because secrets collection and persistence are outside the immediate content-generation task and increase the risk of credential exposure, misuse, or storage in logs/shell history. The surrounding context does not justify direct secret handling by the agent when a platform secret store or user-managed configuration flow should be used instead.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: The skill instructs the agent to locally transform user-supplied files and, if needed, install additional packages such as Pillow or sharp-cli to do so. While the stated goal is image-size compliance, this still expands execution scope beyond the core skill purpose and adds dependency-install risk plus extra handling of user content. The context makes it less severe than credential handling, but it remains a real least-privilege issue.

Static analysis

No suspicious patterns detected.