MiniMax H3 爆款视频复刻 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:18 AM UTC
• Version: 0.1.1

Overview

The skill’s video-generation purpose is coherent, but it asks users to share an API key in chat and directs agents to install mutable global dependencies, so users should review it before installing.

Install only if you are comfortable with qhkit and the Qinghu service. Do not paste API keys into chat; configure credentials through a local secret mechanism or environment variable yourself, and prefer pinned, local, reviewed dependencies instead of global @latest or npx --yes installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:49
• Finding: Automatic Installation and Execution of Unpinned Third-Party Packages## Vulnerability Details **File Location**: `SKILL.md:49-55`, `SKILL.md:75-81`, and `SKILL.md:91` **Vulnerability Type**: Supply-chain exposure through mutable dependencies **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The image-processing fallback also instructs the Agent to install or execute mutable packages using commands equivalent to: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill automatically installs and executes third-party packages without pinning reviewed versions or verifying package integrity. The explicit `@latest` upgrade is particularly unsafe because the code executed by the Skill can change after this audit without any change to `SKILL.md`. Global npm installation may run package lifecycle scripts and place executables in the global npm prefix. The `npx --yes` mechanism automatically downloads and executes a package without a separate approval step. The Python fallback similarly installs an unpinned package from a mirror. A compromised publisher account, registry, mirror, transitive dependency, or newly published malicious release could therefore introduce arbitrary code. Global installation exceeds the minimum privilege scope needed for a single Skill invocation. A project-local, version-pinned, isolated dependency would be sufficient. The instructions do not explicitly request root access, so this is not a confirmed privilege-escalation issue; malicious package code would execute with the existing Agent user's privileges. The separately flagged Node.js download at lines 60-61 is not a `curl | bash` command. It downloads a versioned archive and verifies it before extraction. However, when the mirror fallback is used, the archive and checksum can originate from the same mirror, which weakens ...[truncated 1388 chars]
• Remediation: ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version; remove `@latest`. 2. Record and verify package integrity hashes or distribute dependencies through a controlled, authenticated artifact repository. 3. Use a project-local installation with a lockfile instead of global installation. 4. Run dependencies in an isolated, least-privilege environment with only the media files required for the task mounted. 5. Disable automatic `npx --yes` downloads. Install a pinned `sharp-cli` version through the same controlled dependency process. 6. Pin Pillow to a reviewed version and prefer the authenticated official index or an internally controlled mirror. 7. Require explicit user approval before installing or upgrading executable dependencies. 8. Disable unnecessary npm lifecycle scripts where compatible, and review the package and its transitive dependency tree before execution. 9. For Node.js bootstrap, pin the expected SHA-256 digest in the reviewed Skill or verify an official cryptographic signature. Do not obtain both the archive and its trust value solely from the same fallback mirror.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67
• Finding: API Token Requested Through Chat and Passed as a Command-Line Argument## Vulnerability Details **File Location**: `SKILL.md:67-72` **Vulnerability Type**: Insecure secret collection and command-line disclosure **Risk Level**: Medium ### Vulnerable Code The Skill tells the user to send the generated API key to the Agent and then supplies it directly through this command structure: ```bash qhkit config set --token API_KEY --env prod ``` It alternatively permits use of the `QHKIT_TOKEN` environment variable. ### Technical Analysis Requesting that a user send an API key through the conversation places the secret in Agent context and potentially in conversation histories, telemetry, debugging records, backups, or operator-visible logs. This creates unnecessary exposure because the video-generation workflow only requires the CLI to access the credential; the Agent does not need to receive the plaintext token in chat. Supplying the token as a command-line argument creates another exposure channel. Depending on the execution environment, command arguments may be visible in process listings, shell history, audit logs, command traces, or error reports. The environment-variable alternative avoids process arguments but can still leak through inherited process environments or diagnostic output if not handled carefully. The Skill states that `qhkit config show` should return redacted configuration, which is a useful safeguard, but it does not mitigate disclosure that already occurred in chat or the process command line. ### Attack Path 1. The Skill directs the user to generate an API key and send it in the conversation. 2. The plaintext token becomes part of the conversation or Agent execution context. 3. The Agent inserts the token into a CLI command-line argument. 4. A party with access to conversation storage, execution logs, process metadata, shell history, or debugging telemetry retrieves the token. 5. The exposed token is reused against the Qinghu API. 6. The attacker submits tasks, access ...[truncated 705 chars]
• Remediation: ## Remediation Suggestions 1. Do not ask users to paste API tokens into chat. 2. Direct users to enter the token through a masked terminal prompt, operating-system credential store, or platform secret-management interface. 3. Modify `qhkit` to accept credentials through standard input or a protected file descriptor rather than a command-line argument. 4. If a configuration file is required, create it with owner-only permissions and ensure the CLI never prints the plaintext token. 5. Avoid storing secrets in shell history, process arguments, task transcripts, telemetry, or error messages. 6. Restrict environment-variable inheritance to the single process that requires the credential. 7. Use narrowly scoped, short-lived, and revocable API tokens where supported. 8. If a token has already been shared in chat, instruct the user to revoke and rotate it immediately rather than continuing to use it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to ask the user to paste a Qinghu API key into chat and then configure it locally. Collecting reusable secrets in-band is broader than the end-user task and creates a clear credential-handling risk: chat logs, traces, or downstream tools may expose the token, enabling unauthorized use of the user's account and credits. In this context, the danger is elevated because the secret grants access to a third-party service and is not necessary to be revealed directly to the model.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill contains extensive environment-bootstrapping instructions to install Node, global npm packages, and optional image-processing tools. While framed as reliability guidance, this expands the skill's operational scope beyond simple video-cloning assistance and encourages the agent to alter the host environment and pull code from external registries, increasing supply-chain and system-modification risk. The context makes this more dangerous because the instructions say not to give up when dependencies are missing, pushing the agent toward autonomous installation behavior.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to solicit an API key from the user and have it transmitted back through the conversation for later use. This is a direct secret-exfiltration pattern: reusable credentials become visible to the model, stored in logs, and potentially accessible to other components, which can lead to account compromise, unauthorized spending, and persistent abuse. Because the skill only needs the environment to be authenticated, asking for the raw key in chat is unnecessary and especially unsafe.

Static analysis

No suspicious patterns detected.