AI电商主图轮播图 | 主图套图 | 商品首图 | SKU图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:18 AM UTC
• Version: 0.1.5

Overview

This skill is for generating e-commerce product image sets, but it tells the agent to install and run mutable global npm tooling and configure a production API token in ways users should review first.

Review this before installing. Use it only if you trust the @iqinghu/qhkit npm package and LinkPix service, prefer a pinned reviewed version and local install where possible, avoid putting real tokens directly in shell commands, and assume uploaded product images and prompts are sent to the external service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38
• Finding: Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:38-45, 60-66` **Vulnerability Type**: Unpinned and mutable npm dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```text Only when global installation fails because of permissions and privilege elevation is unavailable, fall back to `npx @iqinghu/qhkit <command> ...`. ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit switching npm downloads to the third-party mirror `https://registry.npmmirror.com`. ### Technical Analysis The Skill directs the agent to install or execute `@iqinghu/qhkit` without pinning it to a reviewed version or verifying package integrity. Both the unversioned npm installation and the explicit `@latest` upgrade resolve to mutable package content at execution time. The `npx` fallback can likewise download and immediately execute the currently published package. npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Those scripts and the installed CLI run with the permissions of the invoking user. A compromised package release, maintainer account, registry response, or mirror could therefore introduce executable behavior that was not present when this Skill was audited. A global installation is broader than necessary for invoking a single image-generation command. It modifies the user's shared command environment and makes the unreviewed executable available to subsequent sessions. The mirror fallback introduces an additional supply-chain trust boundary. This finding does not establish that `@iqinghu/qhkit` or the named mirror is currently malicious. The vulnerability is the mutable, unverified dependency retrieval and immediate execution model. ### Attack Path 1. An attacker compromises the npm package maintainer account, package publication process, registry delivery path, or permitted mirror. 2. The at ...[truncated 1396 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a specific reviewed version, for example `@iqinghu/qhkit@X.Y.Z`, rather than using an unversioned package or `@latest`. 2. Record and verify npm integrity metadata through a committed lockfile or an equivalent trusted checksum mechanism. 3. Replace global installation with a project-local, locked installation so the package does not modify the user's shared command environment. 4. Avoid automatic upgrades in response to remote CLI messages. Require explicit user approval and security review before changing versions. 5. Do not use `npx` to retrieve and immediately execute an unpinned package. If `npx` is necessary, specify an exact reviewed version and prevent unintended package substitution. 6. Evaluate installation with lifecycle scripts disabled using `--ignore-scripts`. If lifecycle scripts are required, review and document them before execution. 7. Use only explicitly trusted registries. If a mirror is supported, document its trust implications and apply the same version and integrity verification used for the primary registry. 8. Run installation and CLI operations as a non-privileged user in a restricted environment with access limited to the required input images and output directory.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: API Token Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:57` **Vulnerability Type**: Sensitive credential supplied as a process argument **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <secret> --env prod ``` The same instruction permits configuration through the `QHKIT_TOKEN` environment variable. ### Technical Analysis The documented configuration command places the API token directly in the process argument vector. Depending on the shell and operating-system configuration, the value may be retained in shell history, command transcripts, agent execution logs, telemetry, terminal recording, or diagnostic output. While the command is running, process-inspection facilities may also expose its arguments to authorized local observers. Environment variables may reduce shell-history exposure but are not a complete secret-storage mechanism. They can be inherited by child processes and may be captured by diagnostics, crash reports, or process inspection. The Skill does not specify secure token prompting, redaction guarantees, storage permissions, or credential rotation procedures. ### Attack Path 1. A user obtains a production API token and follows the documented configuration command. 2. The literal token is inserted into the shell command line. 3. The shell, agent framework, terminal recorder, audit facility, or command logger stores the submitted command; alternatively, a local observer inspects the process arguments while the command is active. 4. An attacker with access to that history, log, telemetry data, or permitted process information extracts the token. 5. The attacker submits unauthorized requests to the service using the compromised credential until it is revoked or expires. ### Impact Assessment Exposure could allow unauthorized use of the associated LinkPix/qhkit account and consumption of its credits. The attacker may be able to invoke functions authorized by that API token a ...[truncated 344 chars]
• Remediation: ## Remediation Suggestions 1. Add an interactive configuration mode that reads the token through a hidden terminal prompt rather than a command-line option. 2. Support reading the token from standard input or a protected file descriptor without echoing or logging it. 3. If environment-variable configuration remains supported, warn users about inheritance and diagnostic exposure, and unset the variable immediately after configuration. 4. Ensure the CLI and agent framework redact token values from stdout, stderr, debug logs, telemetry, and error messages. 5. Store the configured token in an operating-system credential manager where available. If file storage is necessary, enforce restrictive user-only permissions. 6. Avoid placing real tokens in shell history. Document safe procedures for removing accidental history entries and rotating exposed credentials. 7. Use narrowly scoped, revocable tokens and provide explicit rotation and revocation instructions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger metadata uses very broad, everyday phrases such as “给这张商品图出一组图” and generic terms like 主图/轮播图/五图/九图, which can match many normal image-editing requests beyond the intended product-image workflow. Because this skill is user-invocable and can install/run external tooling, over-broad activation increases the chance of unintended execution, unnecessary package installation, and prompting users for tokens when they did not explicitly request this vendor-specific capability.

Static analysis

No suspicious patterns detected.