Nano Banana 2 电商爆款素材生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill is for image generation, but it asks users to share an API key in chat and can install or upgrade unpinned command-line tools globally, so it needs review before use.

Install only if you are comfortable with qhkit/Nano Banana 2, external image upload, and credit-consuming generation. Do not paste API keys into chat; set QHKIT_TOKEN or qhkit credentials yourself in a secure local terminal or secret manager. Prefer a pinned, local install over global @latest installs, and approve any package installation or upgrade explicitly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57
• Finding: Unpinned third-party packages are downloaded and executed with unnecessary global scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:57-60`, `SKILL.md:83-86`, and `SKILL.md:96` **Vulnerability Type**: Unpinned dependency installation and immediate execution of remotely retrieved packages **Risk Level**: Medium ### Complete Code Snippets ```bash npm i -g @iqinghu/qhkit ``` The documentation also instructs the Agent to use an alternative npm registry when the official registry is slow and permits execution through `npx`. ```bash npm i -g @iqinghu/qhkit@latest ``` For image compression, additional unpinned packages may be installed or executed: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i ORIGINAL_IMAGE -o COMPRESSED_IMAGE.jpg resize 2048 ``` ### Technical Analysis These instructions retrieve mutable third-party packages and execute their code without pinning reviewed versions or verifying package integrity. In particular: - `@iqinghu/qhkit` is installed globally without a fixed version. - The upgrade instruction explicitly installs the mutable `latest` release. - `npx --yes sharp-cli` automatically downloads and executes the currently resolved package without interactive approval. - npm packages may run lifecycle scripts during installation. - Alternative npm and Python package mirrors expand the supply-chain trust boundary. - A global npm installation modifies the user's persistent executable environment, although the declared image-generation function only requires a task-scoped CLI. Consequently, the effective code executed by the Skill can change after this document has been audited. A compromised publisher account, malicious new release, registry compromise, dependency compromise, or unsafe mirror response could introduce arbitrary code. The Node archive installation at `SKILL.md:65-66` is not a `curl | bash` pattern. It downloads an archive and verifies it against the corresponding checksum manifest before extraction. However, the documented mirror fallback obtains b ...[truncated 1659 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a specific reviewed version rather than using an implicit current version or `@latest`. 2. Record and verify package integrity hashes or use a lockfile generated from a trusted dependency review. 3. Prefer a project-local, isolated installation over `npm -g`; expose the executable through a controlled wrapper or fixed local path. 4. Replace `npx --yes sharp-cli` with a pinned and preinstalled image-processing dependency. 5. Use a virtual environment for Python dependencies and pin Pillow to a reviewed version with a verified hash. 6. Avoid automatically switching registries. If mirrors are required, maintain an explicit allowlist and apply independent integrity verification. 7. Consider disabling npm lifecycle scripts during installation where package functionality permits it. 8. Require user approval before installing or upgrading executable dependencies. 9. Pin the trusted Node archive digest directly in the Skill or another independently controlled manifest so archive validation does not rely solely on a checksum downloaded from the same host or mirror. 10. Document cleanup procedures for local dependencies and avoid persistent host modification unless explicitly requested. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:72
• Finding: API credential is requested through the conversation and passed in a command-line argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72-77` **Vulnerability Type**: Plaintext credential exposure through chat and process arguments **Risk Level**: Medium ### Complete Code Snippet ```bash qhkit config set --token <API_KEY> --env prod ``` The same section permits use of the following environment variable: ```text QHKIT_TOKEN ``` The surrounding instruction directs the user to generate an API key and send that key to the Agent before the configuration command is executed. ### Technical Analysis The Skill asks the user to disclose an API credential directly in the conversation. Credentials entered in chat may be retained in conversation history, telemetry, execution traces, support exports, or other platform logs. The document does not provide a secure secret-entry channel, automatic redaction, retention limitations, or revocation guidance. The suggested `--token` command-line argument creates another exposure channel. Depending on the operating system and execution environment, command arguments can appear in: - Process listings while the command is running. - Shell history. - Agent tool-call records. - Debugging output and execution logs. - Audit or observability systems. Although an environment variable is mentioned as an alternative, the instructions still direct the user to send the secret to the Agent and do not require a protected secret manager. ### Attack Path 1. The user follows the Skill's setup instructions and pastes an API key into the conversation. 2. The plaintext key is retained in chat history, Agent traces, logs, or a tool invocation. 3. Alternatively, the Agent inserts the key into the `--token` command-line argument, exposing it to process inspection or shell logging. 4. A person or service with access to those records retrieves the credential. 5. The credential is reused against the Qinghu service before it is revoked. 6. The attacker performs operations authorized by the key, including potentially char ...[truncated 669 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys into the conversation. 2. Direct users to configure `QHKIT_TOKEN` themselves through the platform's secret manager or a protected local terminal. 3. Use a secure, non-echoing credential prompt if direct configuration is unavoidable. 4. Avoid passing secrets through command-line arguments. 5. Ensure tokens are redacted from tool calls, stdout, stderr, telemetry, and error messages. 6. Store credentials only in a protected credential store or configuration file with restrictive user-only permissions. 7. Document how users can revoke and rotate a token if accidental disclosure occurs. 8. Prefer short-lived, narrowly scoped credentials where the vendor supports them. 9. Verify that `qhkit config show` cannot reveal the complete token and that configuration files are not written with group or world-readable permissions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill contains extensive environment-bootstrapping and software installation instructions, including installing Node.js, global npm packages, and fallback image-processing tooling. While operationally useful, this expands the skill from image generation into system modification and package execution, increasing supply-chain and host-integrity risk if invoked automatically or in sensitive environments.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send an API key in chat and then configure it via command line. Collecting secrets through normal conversation creates a credential-exposure path through chat logs, agent memory, transcripts, and downstream tooling, which is unnecessary and risky for a media-editing skill.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger metadata is broad and keyword-heavy, covering many common image-editing and e-commerce design requests without strong exclusion criteria. This can cause the skill to activate in unintended contexts, increasing the chance that its installation steps, credential handling, or external CLI usage are invoked when a simpler or safer path was appropriate.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The markdown trigger section repeats broad, generic activation guidance such as common ad-creative and image-editing tasks, making accidental invocation likely. In the context of a skill that can install software and request credentials, over-triggering materially increases exposure and misuse potential.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill instructs the agent to solicit an API key directly from the user in chat and then apply it with `qhkit config set --token <密钥>`. This is a direct secret-handling anti-pattern: the secret may be stored in conversation history, observability systems, or agent logs, and the agent becomes a conduit for credential collection outside a secure authentication flow.

Static analysis

No suspicious patterns detected.