电商印花提取 | 图案提取 | POD印花 | 高清印花 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.5

Overview

The skill performs the advertised image-pattern extraction, but it asks the agent to make broad local environment changes and follow upgrade commands from tool output.

Install only if you are comfortable with qhkit being installed globally, local images being uploaded to the provider, and an API token being configured. Prefer a pinned package version, avoid running upgrade commands copied from tool output, and use a secret manager or environment variable handling that will not expose the token in command history.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43
• Finding: Unpinned Global Installation of a Mutable npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 and 58–64 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The upgrade instructions also use a mutable release tag: ```bash npm i -g @iqinghu/qhkit@latest ``` The Skill additionally permits installation through this fallback registry: ```bash npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install `@iqinghu/qhkit` globally without pinning an audited version or package integrity digest. The `latest` tag is explicitly used during upgrades, so the installed code can change after the Skill itself has been reviewed. npm installation can run package lifecycle scripts. A malicious or compromised package release could therefore execute code with the permissions of the user running npm. Global installation also modifies a shared user or system-level tool environment rather than creating a task-scoped, isolated dependency. The fallback mirror creates an additional supply-chain trust boundary. Although the documented package name appears intentional and no evidence shows that the current package is malicious, the installation procedure does not independently verify package provenance or integrity. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry response, or permitted mirror. 2. The attacker publishes or serves a modified version of `@iqinghu/qhkit`, potentially under the mutable `latest` tag. 3. The Agent follows the Skill instructions and performs a global npm installation or upgrade. 4. npm downloads the attacker-controlled package. 5. Package lifecycle scripts execute with the invoking user's privileges, or the installed `qhkit` executable runs malicious logic later. 6. The malicious package can access files, environment variables, API tokens, and network resources ...[truncated 698 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically audited version rather than using an unqualified package name or `@latest`. 2. Verify package integrity using a trusted lockfile, expected npm integrity digest, or independently published checksum. 3. Install the dependency in a task-scoped directory or isolated container instead of globally. 4. Require explicit user approval before modifying the environment or installing dependencies. 5. Avoid alternate registries unless necessary and explicitly approved. Apply the same integrity verification regardless of the selected registry. 6. Consider disabling lifecycle scripts during installation where compatible, then invoke only reviewed package entry points. 7. Document the expected publisher, version, integrity value, and resolved registry before installation. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:58
• Finding: Blind Execution of Upgrade Commands Supplied Through CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–64 **Vulnerability Type**: `T07: Tool Hijacking and Spoofing` **Risk Level**: High ### Complete Relevant Instruction The Skill states that when the command returns an object resembling: ```json {"ok":false,"stage":"version","message":"..."} ``` the `message` field contains the upgrade command and directs the Agent to execute that command as instructed. A separately documented upgrade command is: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill treats runtime text from the CLI's `message` field as trusted executable instructions. Output from a command or remote-backed service is data and must not be interpreted as an authorization channel for arbitrary shell execution. A malicious executable named `qhkit` earlier in `PATH`, a compromised installed package, or a compromised service response could generate a forged version-gate response containing an attacker-selected command. The Agent is then instructed to execute that command without checking it against a fixed allowlist. This creates a confused-deputy condition: a seemingly legitimate tool response can redirect the Agent from the declared image-processing task into arbitrary command execution. ### Attack Path 1. An attacker replaces or shadows the `qhkit` executable, compromises the npm package, or gains influence over the response used by the CLI. 2. The malicious component returns a response with `stage` set to `version`. 3. The `message` field contains an attacker-controlled shell command presented as an upgrade command. 4. The Agent follows the Skill instruction to execute the command “as instructed.” 5. The command executes with the Agent process user's permissions. 6. The attacker can read or modify accessible files, steal credentials, install additional software, or transmit data externally. ### Impact Assessment Exploitation can result in arbitrary command execution with the privileges of ...[truncated 548 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never execute shell commands extracted from a CLI `message`, standard output, standard error, API response, or other runtime text field. 2. Replace the instruction with a fixed, locally defined allowlist of permitted upgrade operations. 3. Pin the permitted upgrade target to a reviewed version rather than using `@latest`. 4. Resolve and verify the path of the `qhkit` executable before trusting its output. 5. Validate package provenance and integrity independently of the currently installed CLI. 6. Display upgrade information to the user and require explicit approval before modifying installed software. 7. Parse responses strictly as data. Reject unexpected fields, shell metacharacters, URLs, or command strings rather than forwarding them to a shell. 8. Run upgrade operations in a restricted, isolated environment with minimal filesystem and credential access. ]]>

other

Warning

• Location: SKILL.md:66
• Finding: Local Images Are Automatically Uploaded to an External Service Without a Required Consent Check<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–71 **Vulnerability Type**: `other: External Data Disclosure Risk` **Risk Level**: Medium ### Complete Relevant Instruction The invocation contract states that image and video parameters may contain local file paths and that the CLI automatically uploads those files to obtain URLs. It also permits direct use of public HTTP or HTTPS URLs. The documented invocation pattern is: ```bash qhkit image generate '{"modelLabel":"智慧模型","uploadedImages":["./穿着图.jpg"],"prompt":"..."}' ``` ### Technical Analysis The Skill's primary function relies on external image generation, so transmitting an image to the declared service is functionally relevant. However, the instructions permit automatic upload of any supplied local path without requiring the Agent to obtain explicit informed consent immediately before transmission. Users may reasonably interpret a local path as a request to process a local file without understanding that the complete file will be transferred to a third party. Images can contain sensitive visual information and metadata, including location, device, timestamp, identity, or business information. The audited instructions identify the service ecosystem but do not require disclosure of the upload destination, retention policy, privacy terms, metadata handling, or data residency before the upload occurs. ### Attack Path 1. A user provides a local image path for pattern extraction. 2. The Agent invokes `qhkit image generate` with that local path. 3. The CLI automatically uploads the file to the external qhkit or LinkPix service. 4. The external service receives the image and any metadata retained in the uploaded file. 5. The user may only learn that an external transfer occurred after the data has already left the local environment. This issue does not require an active attacker. If the service, account, transport endpoint, or dependency is later compromised, the externally tra ...[truncated 661 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Before the first upload, explicitly inform the user that the local file will be transferred to the qhkit or LinkPix service. 2. Obtain affirmative consent for the external upload, particularly for private, confidential, or personally identifiable content. 3. State the destination service and provide relevant privacy, retention, and deletion information. 4. Strip unnecessary EXIF and other metadata before upload unless preservation is required. 5. Validate that the selected path refers only to the intended image and not to an unintended or sensitive file. 6. Minimize the transmitted file by cropping or redacting unrelated sensitive regions where practical. 7. Avoid logging tokens, local paths, signed URLs, or generated asset URLs containing credentials. 8. Provide a clear refusal or local-only alternative when the user does not authorize third-party transmission. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill contains extensive environment bootstrap and package installation/upgrade instructions that exceed the narrow purpose of pattern extraction. In an agent setting, this expands the operational scope from image processing to host modification, increasing supply-chain, persistence, and unintended system-change risk if the agent follows the instructions automatically.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to solicit, set, and store API credentials for qhkit, which is sensitive secret-handling behavior beyond simple pattern extraction. In an automated environment this can lead to credential collection, persistence in shell history/config, or misuse of user accounts if the agent requests and configures tokens without strict controls.

Static analysis

No suspicious patterns detected.