Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L03 写明“当用户要求印花裂变、图案变体、衍生设计、一个图案出多版时必须触发”，其中“衍生设计”“图案变体”“一个图案出多版”属于较常见且边界不清的表达。文件虽给出关键词和示例，但没有说明不应触发的情形或更精确的上下文限制，容易与一般设计讨论重叠。
- Content
Security audit
电商印花裂变 | 印花多版本 | 图案裂变 | POD设计 | LinkPix
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent LinkPix/qhkit image-generation helper, but it asks the agent to install and update tooling and overwrite local qhkit configuration with too little user control.
Install only if you are comfortable letting the agent set up qhkit and possibly change your local Node/qhkit configuration. Prefer approving installs explicitly, pinning a qhkit version, and checking whether you use the domestic or international account before letting it overwrite configuration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill includes broad environment bootstrapping steps such as installing Node, installing packages globally, modifying PATH, and handling mirrors, which goes beyond the narrow task of generating pattern variations. This expands the attack surface by encouraging the agent or user to perform privileged or persistent system changes that are not strictly necessary for the business function.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill instructs use of
npx @iqinghu/qhkitwithout pinning a specific version, which allows whatever package version is current at execution time to be fetched and run. In a skill context, this creates supply-chain and reproducibility risk because a compromised or breaking upstream release could execute unreviewed code on the user's machine.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This duplicated finding identifies the same persistence behavior: installing binaries into a user-controlled directory and altering
PATH. In the context of an agent skill, persistence is more dangerous because a user may follow these steps as part of a routine content-generation workflow, unintentionally changing their environment for future commands.- Content
Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This duplicated finding identifies the same persistence behavior: installing binaries into a user-controlled directory and altering
PATH. In the context of an agent skill, persistence is more dangerous because a user may follow these steps as part of a routine content-generation workflow, unintentionally changing their environment for future commands.- Content
Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
L59 明确要求“本技能对接国内版 iqinghu.com”，并指示在检测到 intl 配置时覆盖为国内站，仅在用户“明确说自己用的是国际版”时才保留。这种默认强制区域/站点选择没有先提供用户选项或显式征得偏好确认，属于区域/locale 约束的自然语言策略问题。
- Content