Security audit
Security checks for vulnerabilities and agentic risk
The skill’s image-generation purpose is coherent, but it directs agents to install and run unpinned external tooling and persist environment/configuration changes with limited user-control safeguards.
Review before installing if you do not want agents to modify your Node/npm environment. Prefer a pinned qhkit version, avoid npx/@latest execution where possible, do not add PATH changes to shell startup files unless you intentionally want them persistent, and only provide/upload images and API tokens you are comfortable sending to the LinkPix/qhkit service.
The description says the skill 'must trigger' for broad keyword-driven requests such as pose sets, multiple angles, and social media assets. Broad natural-language triggering can cause unintended invocation on ambiguous requests, leading the agent to install tools, request credentials, or generate content when the user did not explicitly ask for this workflow.
The '何时触发' section contains only a couple of positive examples and lacks constraints or exclusion criteria. In agent settings, underspecified routing increases the chance that the skill is selected for loosely related ecommerce/image-editing tasks, which can expand tool use and external service interaction beyond user intent.
The skill instructs fallback execution via npx @iqinghu/qhkit <命令> ... without pinning a specific version. That allows whatever package version is current at execution time to be fetched and run, creating a supply-chain risk and reducing reproducibility if a compromised or breaking release is published.
This duplicate finding points to the same persistence behavior: unpacking binaries into a user-controlled directory and exporting a modified PATH, with documented persistence into shell startup files. In the context of an agent skill, persisting executables and environment changes can outlive the task and broaden the blast radius of any compromised or misconfigured dependency.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking binaries into a user-controlled directory and exporting a modified PATH, with documented persistence into shell startup files. In the context of an agent skill, persisting executables and environment changes can outlive the task and broaden the blast radius of any compromised or misconfigured dependency.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The file instructs the agent to send the domestic-site key retrieval wording to the user and elsewhere states that CLI messages are already user-facing Chinese and should be relayed as-is. This imposes a specific language/locale on user interactions without offering a choice or documenting an opt-in, which is a natural-language policy concern.