Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Ozon image-generation workflow that uses a third-party CLI and API key, with notable but purpose-aligned install and supply-chain cautions.
Install only if you are comfortable using qhkit/青虎 AI, providing its API key, uploading product images to that service, and allowing npm-based tooling. Prefer a reviewed or pinned qhkit version where possible, review any PATH or global install changes, and confirm estimated credits before generation.
The manifest says the skill 'must trigger' whenever a user asks for Ozon product images, main images, detail images, or activity images, and then lists many keywords. While domain-related, the trigger scope is still broad and does not provide negative examples or clear limits for when similar image-editing requests should not invoke this skill.
The '何时触发' section gives only two positive trigger bullets and does not specify when the skill should not activate. Because the file later mentions neighboring skills for generic storefront images and videos, the absence of negative examples increases the risk of unintended invocation.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact package version, which allows execution of whatever version is current at runtime. That creates a supply-chain risk: a compromised latest release or unexpected breaking change could cause unreviewed code to run in the agent environment.
This duplicated finding points to the same behavior: unpacking binaries into a user-controlled directory and prepending that directory to PATH, potentially across sessions. Even with checksum verification, the persistence aspect expands the blast radius from a single task to future commands run in that shell environment.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same behavior: unpacking binaries into a user-controlled directory and prepending that directory to PATH, potentially across sessions. Even with checksum verification, the persistence aspect expands the blast radius from a single task to future commands run in that shell environment.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The fallback command npx --yes sharp-cli fetches and executes the latest CLI package at runtime with no version pinning. Because this path is triggered during image processing, it can cause arbitrary third-party code to be downloaded and run on demand, increasing supply-chain exposure.
The description emphasizes generating '俄文翻译卖点图' and adapting to Russian consumer preferences as part of the default skill behavior. This can be a language/locale policy issue because it implies a specific locale and language preference without stating that the user should choose or confirm Russian output.