AI生成电商营销素材 | 千川投流素材 | 直通车图 | 节日活动图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill has a coherent marketing-asset purpose, but it asks agents to install and update an unpinned external CLI and follow remotely supplied upgrade instructions.

Review before installing. Use this only in an environment where installing external npm CLIs is acceptable, avoid executing upgrade commands copied from tool output, prefer a pinned and reviewed qhkit version, and provide the token through managed secrets rather than typing it into shell commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:6
• Finding: Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6, 47-50, 68` **Vulnerability Type**: Unpinned executable dependency and unsafe automatic updates **Risk Level**: High ### Complete Code Snippet ```yaml metadata: {"openclaw":{"emoji":"🧰","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```text Only when global installation fails due to permissions and privilege elevation is unavailable, fall back to: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes the third-party npm package `@iqinghu/qhkit` without pinning it to an audited version. Both an unversioned package reference and the explicit `@latest` tag allow the downloaded executable content to change after this Skill has been reviewed. The `npx` fallback can download and immediately execute the current registry version. A global npm installation also modifies the user's shared executable environment rather than using a task-local, isolated dependency. Depending on npm configuration and package contents, package lifecycle scripts may execute during installation. This functionality supports the declared image and video generation workflow, but automatic global installation and unrestricted upgrades exceed the minimum privileges necessary. A locally installed, version-pinned package would provide the required functionality with a smaller supply-chain and system-wide impact. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry response, or an allowed mirror. 2. The attacker publishes a malicious version under `@iqinghu/qhkit` or causes an unsafe package version to be served. 3. The Agent follows the Skill instructions and runs an unversioned global installation, an `npx` invocation, or an `@latest` upgrade. 4. npm downloads the changed package and may execute its ...[truncated 1040 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has undergone security review. 2. Record and verify package integrity using a lockfile or a trusted SHA-512 integrity value. 3. Remove `@latest` and do not permit automatic version changes based solely on runtime prompts. 4. Prefer a project-local installation in an isolated directory over `npm i -g`. 5. Avoid unversioned `npx` execution. If `npx` is required, specify an exact version and prevent implicit fallback to another package version. 6. Disable npm lifecycle scripts with `--ignore-scripts` where compatible with the package. 7. Require explicit user approval before installing or upgrading executable dependencies. 8. Use only an approved registry and avoid dynamically switching registries unless the mirror is independently trusted and governed. 9. Run the CLI in a sandbox with access limited to the specific input files and required network endpoints. 10. Expose the API token only to the individual CLI process rather than retaining it broadly in the Agent environment. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Execution of Remotely Supplied Upgrade Commands Without Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65-68` **Vulnerability Type**: Unvalidated remote command execution instruction **Risk Level**: High ### Complete Code Snippet ```text **Upgrade**: If any of the following signals appear, upgrade before retrying the original command— the command returns `{"ok":false,"stage":"version",...}` (version gate; the message contains the upgrade command, execute it as instructed); stderr indicates a new version; `options` returns `catalogNotice` and the user needs that new model; or the service reports that the online mode has been removed or changed and qhkit must be upgraded. ```bash npm i -g @iqinghu/qhkit@latest ``` ``` ### Technical Analysis The Skill instructs the Agent to execute an upgrade command supplied in a runtime `message` field. That field may originate from the installed CLI or a remote backend used by the CLI. Treating its contents as trusted shell instructions creates a remote command-execution channel. The command is not restricted to a fixed executable and argument allowlist, parsed as structured version data, or presented for explicit user approval. If either the local CLI or remote service is compromised, the returned message could contain arbitrary shell syntax rather than a legitimate npm upgrade command. The hard-coded example does not eliminate the risk because the surrounding instruction explicitly says to execute the command found in the message. ### Attack Path 1. An attacker compromises or impersonates the qhkit backend, compromises the installed CLI, or otherwise controls the returned version-gate response. 2. The attacker returns `stage:"version"` with a `message` containing a malicious shell command. 3. The Agent interprets the message as an authorized upgrade instruction. 4. Following the Skill directive, the Agent executes the supplied text in a shell. 5. Shell metacharacters, command substitution, pipelines, or chained commands execute the attacker's payload. 6. T ...[truncated 915 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute command text returned in `message`, stderr, or any other remotely influenced output. 2. Treat the response only as a signal that an update may be needed. 3. Parse a version identifier as structured data and validate it against a strict semantic-version format. 4. Construct any permitted update command locally from fixed tokens; never pass returned text to a shell. 5. Pin updates to an explicitly approved version rather than using `@latest`. 6. Require explicit user confirmation before updating executable dependencies. 7. Reject shell metacharacters and unexpected fields, although validation must not replace fixed command construction. 8. Verify package integrity and provenance before installation. 9. Run updates and the CLI in a least-privilege sandbox. 10. Log the requested version, validated package identity, integrity value, and user authorization for auditability. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill includes explicit instructions to install or upgrade Node.js and globally install a CLI, which expands its effective capability from generating marketing assets into host environment modification and package management. Even if framed as setup convenience, this can cause the agent to make persistent system changes or fetch and execute external software, increasing supply-chain and environment-integrity risk beyond the declared business purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill directs the agent to obtain and configure an API token via command line or environment variable, creating credential-handling behavior not narrowly scoped in the manifest. This is dangerous because it can normalize prompting for secrets, storing them in shell history or process environments, and broadens the skill from content generation into secret collection and configuration.

Vague Triggers

High

• Confidence: 80% confidence
• Finding: The description says the skill 'must trigger' for broad classes of requests such as marketing, advertising, promotion, and campaign assets, which can force activation across many loosely related user prompts. Overbroad mandatory triggers raise the chance that this higher-risk skill is invoked unnecessarily, exposing users to installation steps, token setup, and external tool execution when a narrower or safer skill would suffice.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The trigger guidance says to use this skill when needs span images and video or require bundled delivery, but the boundary with specialized LinkPix skills is only clarified much later and remains ambiguous. That ambiguity can cause the agent to invoke the broader skill by default, unnecessarily inheriting its dependency installation, credential setup, and external generation workflow.

Static analysis

No suspicious patterns detected.