电商服装多姿势套图 | 模特姿势生成 | 多角度展示 | 服装套图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:18 AM UTC
• Version: 0.1.5

Overview

The skill is purpose-aligned for generating clothing model pose sets, but it asks agents to install and update an unpinned global npm CLI and handle an API token in ways users should review carefully.

Install only if you trust the @iqinghu/qhkit npm package and LinkPix service. Prefer a pinned/local install, avoid npx or automatic @latest upgrades, and provide the API token through a secret manager or protected environment variable rather than pasting it into a command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7, 42–46, and 68 **Vulnerability Type**: Supply-chain risk from mutable npm dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🕺","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit execution through an unpinned `npx` invocation: ```bash npx @iqinghu/qhkit <command> ... ``` Updates explicitly install the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and immediately executes `@iqinghu/qhkit` without pinning it to a reviewed version or integrity value. Both an omitted version and the `@latest` tag are mutable references whose resolved contents may change after this Skill has been audited. npm package installation can execute package lifecycle scripts, while subsequent `qhkit` or `npx` calls execute code supplied by the package. The project contains no copy of that implementation, lockfile, or integrity metadata, so the package's effective behavior cannot be verified from the audited artifact. Global installation increases the affected scope by placing the executable in a shared user or system installation location. The fallback npm mirror introduces an additional distribution trust boundary. The instructions do not explicitly require elevated privileges, so root-level compromise cannot be assumed; execution normally receives the permissions of the user running the agent. ### Attack Path 1. An attacker compromises the package maintainer account, an npm distribution path, or the documented fallback registry. 2. The attacker publishes a malicious release under the existing package name or changes the version selected by the mutable `latest` reference. 3. The Skill follows its bootstrap or upgrade instructions and runs `npm i -g @iqinghu/qhkit`, `npx @iqing ...[truncated 934 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using an omitted version or `@latest`. 2. Record and verify package integrity using a lockfile and npm integrity metadata. 3. Avoid automatic global installation. Prefer a project-local, isolated installation with narrowly scoped filesystem permissions. 4. Do not automatically upgrade in response to remote CLI messages. Require explicit user approval and review the target version before installation. 5. Avoid `npx` behavior that can download missing packages implicitly. Use a previously installed and verified executable. 6. Where compatible, disable npm lifecycle scripts during installation with `--ignore-scripts`, then explicitly run only reviewed setup operations. 7. Restrict installation and execution in a sandbox that exposes only the required input images, output directory, network destinations, and credentials. 8. Treat the fallback mirror as a separate trust boundary and verify that retrieved package integrity matches trusted, independently obtained metadata. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:63
• Finding: API Token Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Low ### Vulnerable Code ```bash qhkit config set --token <key> --env prod ``` ### Technical Analysis The documented configuration method places the LinkPix API token directly in a command-line argument. After the placeholder is replaced with a real credential, the token may be recorded in shell history, terminal transcripts, agent execution logs, command auditing systems, or process telemetry. Depending on the operating system and process visibility settings, another local user may also be able to inspect command-line arguments while the process is running. Although the Skill mentions `QHKIT_TOKEN` as an alternative, it does not make a protected input mechanism the default or warn users about the exposure created by passing the token on the command line. ### Attack Path 1. The user obtains a LinkPix API token and substitutes it into the documented command. 2. The command is executed by the shell or agent runtime. 3. The complete command, including the token, is retained in shell history, terminal logs, agent traces, process monitoring, or audit telemetry. 4. An attacker with access to one of those local records retrieves the credential. 5. The attacker uses the token against the LinkPix API under the victim's account. ### Impact Assessment A recovered token may allow unauthorized use of the victim's LinkPix account capabilities and consumption of account credits. The exact API permissions and access to historical resources cannot be established from `SKILL.md`, so broader account access is not asserted. Exploitation requires access to local process information or retained command logs. It does not itself grant operating-system privilege escalation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the command-line token argument with an interactive hidden prompt or standard-input mechanism that does not echo or retain the credential. 2. Prefer integration with an operating-system credential store or the agent platform's secret-management facility. 3. If `QHKIT_TOKEN` must be used, inject it only into the target process through a secret manager rather than placing it in a persistent shell profile or command history. 4. Explicitly warn users not to paste tokens into commands that may be logged. 5. Ensure application and agent logs redact token values and authorization data. 6. Store any resulting configuration file with permissions limited to its owner and verify that `qhkit config show` never prints the complete token. 7. Document token revocation and rotation procedures for users who may already have exposed a credential. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger text says the skill 'must' activate for broad, common e-commerce image requests, but it does not define meaningful exclusion conditions or prioritization against other overlapping skills. In an agent setting, this can cause over-invocation, inappropriate tool selection, and unintended execution of installation/configuration steps for routine user requests that may not actually require this specific external CLI.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: The '何时触发' section uses example-driven, open-ended guidance rather than a strict trigger contract, which increases ambiguity in when the skill should run. Because this skill performs external tool setup and image generation workflows, vague activation examples can lead to unnecessary invocation and accidental use outside the intended niche.

Static analysis

No suspicious patterns detected.