Ozon 商品图、主图套图、详情图、活动图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims for Ozon image generation, but it tells users to paste an API key into chat and uses mutable runtime installs that deserve review before use.

Review before installing. Do not paste your Qinghu API key into chat; configure it yourself through a local environment variable or a secure secret store if possible. Expect the skill to install qhkit and optional image-processing tools, upload product images to Qinghu, and spend Qinghu credits only after you approve generation parameters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:48
• Finding: Runtime Installation and Execution of Mutable Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-65`, `SKILL.md:80`, and `SKILL.md:93` **Vulnerability Type**: Supply-chain exposure through runtime package installation **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The fallback image-processing workflow additionally installs or executes dependencies dynamically: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i INPUT_FILE -o OUTPUT_FILE.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to install and execute third-party software at runtime. The primary `qhkit` package is installed globally, while the upgrade workflow explicitly uses the mutable `@latest` tag. The Pillow installation is not version-pinned, and `npx --yes sharp-cli` can download and immediately execute a package without interactive review. This design prevents the audited `SKILL.md` file from defining the complete executable behavior of the Skill. Package contents can change after the Skill has been reviewed. Package lifecycle scripts and subsequently invoked CLI code execute with the permissions of the Agent process. The optional use of alternate npm and Python package mirrors adds further supply-chain trust boundaries. No evidence establishes that these packages or mirrors are malicious, but the installation mechanism leaves the Skill exposed to package-account compromise, malicious updates, registry compromise, and dependency substitution. ### Attack Path 1. An attacker compromises a referenced package, package maintainer account, registry, mirror, or transitive dependency. 2. The attacker publishes a malicious package version under the expected package name. 3. The Agent follows the environment bootstrap or upgrade instructions. 4. An unpinned command such as `@latest`, `pip install pillow`, or `npx --yes sharp-cli` retrieves the attacker-controlled release. 5. Installation lif ...[truncated 1179 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed, exact version; do not use `@latest` or unconstrained package versions. 2. Verify package artifacts against integrity hashes maintained within a trusted lockfile or signed release manifest. 3. Replace global installation with a project-local installation inside a dedicated, restricted environment. 4. Disable or carefully review package lifecycle scripts where operationally possible. 5. Vendor or prepackage the audited CLI implementation so installation is not performed during Skill invocation. 6. Pin Pillow and `sharp-cli`, including their transitive dependency trees, through lockfiles. 7. Avoid automatic `npx --yes` execution. Install the reviewed package first, verify its integrity, and invoke the pinned local binary. 8. Use official registries by default. If mirrors are required, apply the same artifact-integrity verification rather than trusting the mirror-provided package or checksum alone. 9. Run image processing and remote CLI operations in a sandbox with minimal filesystem access, restricted environment variables, and outbound-network controls. 10. Require explicit user approval before installing or upgrading executable dependencies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:69
• Finding: API Secret Requested Through Conversation and Passed as a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-74` **Vulnerability Type**: Insecure credential collection and handling **Risk Level**: High ### Vulnerable Code The instructions tell the user to generate or copy an API key and send it to the Agent. The Agent is then instructed to configure the key using the following command pattern: ```bash qhkit config set --token API_KEY --env prod ``` The document also offers `QHKIT_TOKEN` as an environment-variable alternative. ### Technical Analysis The Skill explicitly requests that a user disclose an API credential in the conversation. Secrets supplied through chat may be retained in conversation history, Agent traces, telemetry, debugging output, or other session records. The subsequent configuration command passes the secret as a command-line argument. Depending on the host operating system and execution environment, command arguments may be visible through process inspection, execution logs, command auditing, or shell history. Using an environment variable can reduce command-history exposure, but it does not address the original instruction to disclose the token through the conversation and can still expose the credential to child processes or diagnostic collection. The token is functionally required to access the declared image-generation service, but transmitting it through the Agent conversation and exposing it on a command line exceed the minimum-risk credential-handling mechanism needed for that functionality. ### Attack Path 1. The user follows the Skill instructions and posts the Qinghu API key in the conversation. 2. The key is stored or propagated through conversation history, Agent execution traces, or service telemetry. 3. The Agent inserts the key into a `qhkit config set --token ...` command. 4. The complete command may become visible in process listings, shell history, command logs, or debugging output. 5. A person or process with access to any of those records retrieves the ...[truncated 832 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never ask users to paste API keys into the conversation. 2. Direct users to configure the credential themselves through a trusted local prompt, protected settings interface, or platform-managed secret store. 3. Use a non-echoing interactive prompt or protected standard input rather than a command-line argument. 4. If environment variables are used, require users or the execution platform to provision them outside the chat session. 5. Ensure the Agent cannot read or print the secret after provisioning. 6. Redact tokens from standard output, standard error, exception messages, telemetry, and task traces. 7. Store credentials with restrictive filesystem permissions and avoid plaintext persistence where the platform supports a credential vault. 8. Use narrowly scoped, revocable tokens with spending limits and the shortest practical lifetime. 9. Document token rotation and immediate revocation procedures for accidental disclosure. 10. Modify readiness checks so they report only whether a credential exists, never its value or a recoverable representation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send an API key in chat, which creates a direct secret-handling vulnerability. Chat channels are often logged, retained, and exposed to tooling or operators, so collecting credentials there materially increases the risk of credential theft, replay, and unauthorized account use.

Static analysis

No suspicious patterns detected.