电商爆款主图复刻 | 主图模仿 | 高点击主图 | 竞品图复刻 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill appears purpose-aligned for ecommerce image generation, but it asks the agent to globally install and update an unpinned npm CLI and handle an API token in ways that deserve review before use.

Install only if you are comfortable with a globally installed third-party npm CLI and external image-generation service. Prefer a pinned or locally isolated qhkit install, avoid giving the agent tokens directly in command text, and review any generated image for brand, logo, text, and product-detail accuracy before using it commercially.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:39
• Finding: Unpinned Third-Party Package Installation with Global Execution Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–44 and 59–64 **Vulnerability Type**: Supply-chain exposure through mutable npm packages **Risk Level**: High ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The fallback also permits direct package retrieval and execution: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly retrieves the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions additionally permit using a registry mirror: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the agent to install and execute `@iqinghu/qhkit` without pinning an exact audited version or package integrity value. The `@latest` upgrade instruction is explicitly mutable, while the unversioned `npm i` and `npx` forms resolve according to registry state at execution time. npm package installation can execute lifecycle scripts and place executable code on the host. A global installation unnecessarily broadens the installation scope compared with a project-local or isolated installation. Using `npx` does not remove the supply-chain risk because it can download and immediately execute the currently resolved package. The optional registry mirror creates another delivery path whose package contents are not independently pinned in the Skill. There is no evidence that the named package or mirror is currently malicious; the vulnerability is the unsafe trust and execution model. ### Attack Path 1. An attacker compromises the package maintainer account, package release process, upstream dependency, or a permitted registry delivery path. 2. The attacker publishes a malicious version under the legitimate package name or modifies a transitive dependency. 3. The Skill encounters a missing CLI, a version warning, or another documented upgrade condition. 4. The agent runs the unpinned global installation, `npx` fallback, or `@latest` upgrade ...[truncated 916 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific reviewed version rather than using an unversioned package or `@latest`. 2. Record and verify the expected package integrity hash through a lockfile or equivalent integrity mechanism. 3. Prefer a project-local, isolated installation over `npm i -g`. 4. Avoid automatic upgrades based solely on CLI output or remote version notices. Require explicit user approval and validate the proposed version against an allowlist. 5. Do not use `npx` for implicit download-and-execute behavior. If it is unavoidable, specify an exact version and use a controlled npm cache or vetted registry. 6. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup steps. 7. Treat registry mirrors as separate supply-chain trust boundaries. Permit only administratively approved registries and retain integrity verification regardless of source. 8. Execute the CLI in a sandbox with minimal filesystem, environment-variable, and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 56 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Complete Code Snippet ```bash qhkit config set --token <key> --env prod ``` The same section also permits setting the credential through the `QHKIT_TOKEN` environment variable. ### Technical Analysis Passing an API token directly as a command-line argument places the secret in the process argument vector. Depending on operating-system configuration and local permissions, command arguments may be visible through process-monitoring interfaces and administrative tooling. The command can also be retained in shell history, terminal capture, agent execution logs, telemetry, or conversation transcripts. An environment variable is somewhat less likely to enter shell history when configured safely, but it can still be inherited by child processes or exposed through diagnostics. The Skill does not specify redaction, restricted storage permissions, a hidden prompt, or cleanup requirements. ### Attack Path 1. The user obtains a LinkPix API token and supplies it to the agent. 2. The agent substitutes the token into the documented `qhkit config set --token ...` command. 3. The full command is recorded in shell history, execution telemetry, terminal logs, or an agent transcript, or is temporarily visible through process inspection. 4. Another local user, monitoring component, support operator, or later reader with access to those records obtains the token. 5. The exposed token is used to invoke the associated hosted service without authorization. ### Impact Assessment An attacker obtaining the token could act within the API permissions associated with that credential. Plausible impact includes unauthorized image-generation requests, consumption of account credits, access to API-visible account information, and service abuse attributed to the victim. This issue does not e ...[truncated 166 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the command-line token argument with a hidden interactive prompt or protected standard-input mechanism. 2. Ensure the CLI never echoes the token and redacts it from errors, telemetry, debug logs, and agent transcripts. 3. If environment variables must be supported, inject them only into the target process rather than exporting them broadly or persisting them in shell startup files. 4. Store persistent credentials in an operating-system credential manager or a configuration file readable only by the owning user. 5. Disable shell history around credential-entry operations where applicable, while recognizing that this does not address process or agent logging. 6. Document token rotation and immediate revocation procedures for suspected disclosure. 7. Use narrowly scoped, short-lived tokens where the service supports them. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is excessively broad and includes generic phrases like '照着做' and '相似风格主图', which can match ordinary image-editing or comparison requests that are not specifically about this skill. In an agentic environment, overbroad triggers can cause unintended invocation, leading the system to steer users into competitor-style image cloning workflows and external tool use when the user did not clearly request that behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill metadata and content strongly assume Chinese-language interaction and Chinese-language user flows without stating that the skill is locale-restricted or providing fallback behavior for other languages. This can misroute non-Chinese requests, degrade user comprehension, and cause unsafe or incorrect execution of installation, billing, or image-generation steps if users cannot understand the prompts and constraints.

Static analysis

No suspicious patterns detected.