Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L03 将“提取印花、抠图案、把衣服上的图案拿出来、图案素材化”等请求统一定义为“必须触发”，但没有说明不适用场景或负例。像“图案提取”“素材化”这类表述可出现在更广泛的设计语境中，缺少边界会提高非目标场景下的误调用风险。
- Content
Security audit
电商印花提取 | 图案提取 | POD印花 | 高清印花 | LinkPix
Security checks for vulnerabilities and agentic risk
Overview
The skill appears aligned with its image-pattern extraction purpose, but it tells agents to make host changes and configure an API token without clearly requiring user approval.
Review before installing. Only use this skill if you trust the third-party qhkit npm package and are comfortable uploading source images to that service and configuring its API token. Require explicit approval before npm installs, Node downloads, PATH or shell startup changes, token storage, or @latest upgrades; prefer pinned package versions and remove any PATH or token configuration when no longer needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to perform environment-changing operations including global package installation, downloading/extracting binaries, setting PATH, and configuring tokens, but does not front-load a clear warning that these steps modify the host. In agentic settings, hidden or insufficiently signposted system changes increase the risk of unintended persistence, unsafe automation, and token handling on machines where the operator did not expect local modification.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill explicitly recommends falling back to
npx @iqinghu/qhkit <命令> ...without pinning a version, which causes execution of whatever package version is current at invocation time. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed on demand, especially risky because this skill also handles tokens and image-processing workflows.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This duplicate finding points to the same persistence behavior: extracting a runtime into a user-controlled directory and prepending it to
PATH. In the context of an agent skill, modifying shell resolution paths can affect subsequent unrelated tasks and may silently redirect execution to newly installed binaries.- Content
Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This duplicate finding points to the same persistence behavior: extracting a runtime into a user-controlled directory and prepending it to
PATH. In the context of an agent skill, modifying shell resolution paths can affect subsequent unrelated tasks and may silently redirect execution to newly installed binaries.- Content
Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
L13-L16 只给出两个正向示例，其中“这个图案帮我素材化”“POD 设计需要复用现有图案时”仍较概括，没有说明哪些相似请求不应激活该技能。缺少排除条件和更具体的触发范围，容易与一般图片编辑或设计咨询类请求重叠。
- Content