电商印花裂变 | 印花多版本 | 图案裂变 | POD设计 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.5

Overview

The skill does what it claims, but it tells the agent to install and upgrade an unpinned third-party CLI globally and handle an API token in ways users should review first.

Review this skill before installing. Use it only if you trust the qhkit npm package and LinkPix service, prefer a pinned or platform-managed install over the documented global/latest commands, and provide the API token through a secure secret store or protected prompt rather than typing it into a visible command line.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42
• Finding: Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 42-45 and 63 **Vulnerability Type**: Uncontrolled third-party executable dependency **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning an audited version or package integrity value. It also explicitly recommends installing the `latest` release during upgrades and permits package retrieval through a third-party npm mirror. npm packages contain executable JavaScript and may define lifecycle scripts that run during installation. Global installation makes the package available throughout the Agent user's environment. The behavior of an unpinned package can change after this Skill has been audited, so reviewing `SKILL.md` does not establish the safety of the code that will eventually execute. Use of `npx` does not eliminate this risk because it can download and immediately execute the currently resolved package version. ### Attack Path 1. An attacker compromises the package publisher account, npm package, registry infrastructure, or configured mirror. 2. The attacker publishes or serves a malicious release under the expected package name. 3. The Agent follows the bootstrap or upgrade instructions and runs the unpinned global installation, `npx`, or `@latest` command. 4. Malicious package lifecycle scripts or CLI code execute as the Agent's operating-system user. 5. The payload can access data and credentials available to that user, modify user-owned files, and make outbound network requests. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the account running npm or `npx`. This can expose local files, environment variables, API credentials, generated assets, and other ...[truncated 406 chars]
• Remediation: ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specific audited version rather than relying on the registry default or `@latest`. - Verify the package tarball against a separately maintained integrity hash or signed provenance record. - Use a lockfile, trusted internal artifact repository, or reviewed vendored artifact. - Avoid global installation; install the dependency in an isolated, least-privileged project directory or container. - Avoid using `npx` for automatic retrieval and immediate execution of unreviewed versions. - Disable npm lifecycle scripts with `--ignore-scripts` where compatible, then explicitly run only reviewed setup operations. - Require explicit user approval before installing or upgrading executable dependencies. - Treat mirror fallback as a distinct trust decision and verify that mirror-delivered artifacts match the approved package integrity.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: API Token Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <key> --env prod ``` ### Technical Analysis The Skill instructs the user or Agent to pass the production API token directly as a command-line argument. Depending on the operating system and execution environment, command-line arguments may be exposed through process inspection, shell history, terminal capture, debugging output, audit logs, automation logs, or Agent transcripts. Although the Skill also mentions the `QHKIT_TOKEN` environment variable, environment variables may likewise be exposed to child processes and diagnostic collection. Neither method is accompanied by requirements for protected secret input, transcript redaction, secure storage permissions, or post-execution cleanup. ### Attack Path 1. A user supplies the LinkPix API token in the documented command. 2. The shell records the command in history, or the execution framework records it in logs or an Agent transcript. 3. Alternatively, another local process or user observes the command-line arguments while the command is running, where platform permissions permit such inspection. 4. An attacker or unauthorized log consumer extracts the token. 5. The attacker uses the token to authenticate to the associated service account and invoke permitted API operations. ### Impact Assessment Exposure can allow unauthorized use of the LinkPix account within the permissions assigned to the token. Likely consequences include consumption of paid service credits, generation of unauthorized content, access to API-visible account information, and disruption through quota exhaustion. This issue does not by itself grant operating-system privilege escalation. Its scope is primarily the remote service account and any resources accessible through the compromised token.
• Remediation: ## Remediation Suggestions - Accept the token through protected standard input or an interactive no-echo prompt rather than a command-line argument. - Integrate with the platform's secret manager or credential store. - Ensure stored credential files use restrictive permissions accessible only to the Agent user. - Redact tokens from Agent transcripts, command logs, diagnostic output, and error messages. - Prevent secret-bearing setup commands from being written to shell history. - Avoid exporting the token broadly into long-lived environments; scope it to the minimum required process. - Document token revocation and rotation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to bootstrap a runtime by installing Node.js, globally installing qhkit, and configuring authentication if dependencies are missing. That materially expands the skill from image-variation generation into software installation and credential setup, increasing attack surface and enabling unintended system modification or secret-handling workflows on the host.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly directs acquisition and setting of a qhkit API token, including where to obtain it and how to place it on the command line or in environment variables. This introduces credential-handling behavior unrelated to the narrow business task and creates risk of token exposure through shell history, logs, transcripts, or accidental exfiltration by downstream commands.

Static analysis

No suspicious patterns detected.