Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed qhkit/LinkPix workflow for generating marketing images and videos, with expected but noticeable package-install, token, upload, and credit-use requirements.
Install this only if you intend to use LinkPix/qhkit for ecommerce media generation. Expect it to install or update a Node CLI, ask for a qhkit API token, upload referenced product images or media URLs to the provider, and spend service credits after estimates. Review the npm package source/trust and prefer explicit confirmation before persistent PATH changes or global upgrades.
The description says requests for broad categories like 营销素材、广告素材、推广素材、投放素材、活动素材 'must trigger' this skill. That creates overbroad invocation scope, increasing the chance the agent routes unrelated or sensitive requests into a tool that can install software, request tokens, and make external service calls.
The '何时触发' examples are broad and lack clear boundaries, especially for requests like preparing a 'set of promotional assets' or batch delivery across images and video. In context, this makes accidental invocation more likely, which is risky because the skill contains environment-bootstrapping and external package installation guidance.
The skill instructs using npx @iqinghu/qhkit <命令> without pinning a specific package version. That causes execution of whatever version is current at invocation time, expanding supply-chain risk and making behavior non-reproducible if a malicious or compromised release is published.
This duplicate finding points to the same user-directory installation and PATH modification behavior. In a skill that may auto-trigger, persistent environment changes are more dangerous because they outlive the current task and can affect subsequent sessions or tools.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same user-directory installation and PATH modification behavior. In a skill that may auto-trigger, persistent environment changes are more dangerous because they outlive the current task and can affect subsequent sessions or tools.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
No suspicious patterns detected.