AI生成电商pod素材 | 印花提取 | 印花贴合 | 印花裂变 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.5

Overview

The skill’s image-generation purpose is coherent, but it asks agents to install and upgrade a mutable global npm CLI, handle an API token, and potentially run upgrade commands from runtime messages.

Review this skill before installing. Use it only if you trust the qhkit npm package and LinkPix service, avoid automatic installs or upgrades, prefer a pinned local installation, do not execute upgrade commands copied from runtime messages, and provide only image files and API tokens you are comfortable sending to the service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:44
• Finding: Unpinned Third-Party Package Is Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44–47 **Vulnerability Type**: Unpinned executable dependency and unsafe package installation **Risk Level**: High ### Evidence ```bash npm i -g @iqinghu/qhkit ``` The instructions also provide this fallback: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure at line 64 similarly installs a mutable release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes the third-party `@iqinghu/qhkit` npm package without pinning it to a reviewed version or verifying package integrity. A global npm installation can execute package lifecycle scripts and place executable files in a shared command path. The `npx` fallback can download and immediately execute the package. The package implementation is not included in the audited project, so its behavior could not be reviewed. Using the mutable `latest` release also allows the effective executable code to change after this Skill has been audited. The optional registry mirror introduces an additional supply-chain trust point. Installing the CLI is related to the declared image-generation function, but global installation exceeds the minimum scope necessary. A project-local, pinned, integrity-checked, and sandboxed installation would provide the required functionality with less risk. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, configured mirror, or a future package release. 2. The attacker publishes a malicious version of `@iqinghu/qhkit`. 3. The Agent follows the bootstrap or upgrade instructions. 4. `npm -g` or `npx` downloads the mutable malicious version. 5. npm lifecycle scripts or the installed `qhkit` executable run attacker-controlled code. 6. The code operates with the privileges of the Agent process and can access resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code ...[truncated 582 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been independently reviewed. 2. Verify the package with a committed lockfile and npm integrity metadata. 3. Do not use `@latest` in automated Skill instructions. 4. Install the dependency into a dedicated project directory rather than globally. 5. Run the CLI in a sandbox or container with access limited to explicitly selected image files. 6. Restrict filesystem and network access to the minimum needed for the image-generation service. 7. Disable npm lifecycle scripts during installation where compatible, and review any required scripts separately. 8. Treat registry mirrors as distinct trust boundaries and permit only approved, authenticated registries. 9. Require explicit user approval before installing or upgrading executable dependencies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:61
• Finding: Runtime-Provided Upgrade Commands May Be Executed Without Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Unsafe execution guidance for externally supplied commands **Risk Level**: High ### Evidence The instruction states, in English translation: ```text If the command returns a version-gate response, the message contains the upgrade command; execute it exactly as instructed. ``` The document later supplies the expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to trust an upgrade command contained in a runtime `message` field and execute it without validating the command against a fixed local allowlist. Runtime output is not an appropriate trusted source of shell instructions. The message may originate from the installed CLI or a remote service used by that CLI. If either component is compromised, or if an attacker can influence the returned message, the instruction creates a command-execution control channel. A malicious message could specify a command unrelated to package upgrades, include shell metacharacters, download another payload, or access local files. Although the document provides an expected npm upgrade command separately, it explicitly tells the Agent to follow the command in the runtime message. It does not require equality checking, argument validation, user confirmation, or rejection of unexpected shell syntax. ### Attack Path 1. An attacker compromises the `qhkit` package, its backend service, or another component capable of controlling the version-gate response. 2. The attacker causes the CLI to return a response whose `message` contains a crafted shell command. 3. The Agent interprets that message as an authorized upgrade instruction. 4. Following the Skill text, the Agent executes the command without validating it against a local allowlist. 5. The crafted command executes with the Agent user's privileges. 6. The attacker can then access local data, credentials, network s ...[truncated 586 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute commands contained in runtime messages. 2. Define permitted upgrade operations locally using fixed command templates. 3. Pin upgrades to an explicitly reviewed version rather than `@latest`. 4. Parse version responses strictly as data; never pass message contents to a shell. 5. Reject unexpected arguments, shell operators, command substitutions, redirects, and additional commands. 6. Require explicit user approval before any installation or upgrade. 7. Perform upgrades in an isolated environment with minimal filesystem and network access. 8. Log the requested version and validated command without exposing tokens or other secrets. 9. If a version-gate response is encountered, report it to the user instead of automatically executing its suggested command. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to install software, bootstrap Node.js, and configure API credentials at runtime, which expands behavior beyond simple POD asset generation into environment modification and secret handling. In an agent setting, this increases supply-chain, persistence, and credential-exposure risk if triggered automatically or in the wrong context.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The metadata says the skill must trigger whenever users mention broad POD-related keywords, creating a high chance of unintended activation on ordinary design or ecommerce discussions. Over-broad mandatory triggering can cause the agent to run external tooling, request credentials, or steer users into this workflow without clear intent.

Static analysis

No suspicious patterns detected.