AI电商带货视频 | 带货视频生成 | 商品展示视频 | 短视频带货 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.5

Overview

This skill has a coherent video-generation purpose, but it also directs broad automatic system setup, mutable package installation, and token configuration without enough user control or credential-safety guidance.

Review this skill before installing. It is not clearly malicious, but it can change your development environment and install executable code from npm, and it may upload local product images or videos to LinkPix. Prefer a pinned, isolated qhkit installation, avoid global installs and @latest upgrades, and use a secure secret mechanism instead of pasting API tokens into command-line arguments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44–65 **Vulnerability Type**: Unpinned and mutable npm dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning an audited version or package integrity value. It also recommends upgrading to the mutable `latest` release. Consequently, the code executed at installation or invocation time can differ from the code that existed when this Skill was reviewed. npm packages may run lifecycle scripts during installation, and the installed CLI executes with the permissions of the invoking account. The instructions additionally permit using a third-party npm mirror as a fallback, increasing the number of supply-chain systems that must remain trustworthy. A global installation is broader than necessary for executing one video-generation tool. Depending on the npm configuration and invoking environment, it may modify a user-wide or system-wide package location. If installation is performed through an elevated shell, package scripts inherit those elevated privileges. ### Attack Path 1. An attacker compromises the package publisher account, an upstream dependency, npm distribution infrastructure, or the permitted mirror. 2. The attacker publishes a malicious release under the legitimate package name or compromises a transitive dependency. 3. The Agent runs the unpinned global installation, the `latest` upgrade, or `npx` invocation. 4. npm downloads the attacker-controlled version and may execute its lifecycle scripts. 5. The installed CLI subsequently executes attacker-controlled code under the Agent's operating-system account. 6. That code can access files, environment variables, credentials, media assets, and network resources available to that account. ## ...[truncated 634 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific audited version rather than using an implicit current version or `@latest`. 2. Verify the package using a trusted integrity digest, signed provenance, or a checked-in lockfile. 3. Avoid global installation. Use a dedicated, non-privileged project directory or isolated container with a minimal filesystem and network scope. 4. Do not invoke `npx` without a pinned version; prevent it from silently downloading a mutable release. 5. Review package lifecycle scripts and use `--ignore-scripts` where compatible with legitimate functionality. 6. Do not execute upgrade commands copied from package-controlled output without validating them against a fixed allowlist. 7. Prefer the official npm registry. If a mirror is required, independently verify package integrity against trusted metadata. 8. Never perform the installation with administrator or root privileges unless a documented and unavoidable requirement exists. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:59
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Sensitive credential passed as a process argument **Risk Level**: Low ### Vulnerable Code ```bash qhkit config set --token <key> --env prod ``` ### Technical Analysis The documented configuration command places the LinkPix API token directly in the process argument list. Depending on the shell and operating system, this value may be retained in shell history, Agent execution logs, terminal transcripts, audit records, or process-monitoring output. Although some systems restrict access to another user's process arguments, logs and shell history commonly persist beyond the command's lifetime. The Skill does mention `QHKIT_TOKEN` as an alternative, but it does not require secure injection or warn against credential exposure. ### Attack Path 1. A user supplies a valid LinkPix API token to configure the CLI. 2. The Agent interpolates the token into the documented command-line argument. 3. The command or its expanded arguments are retained in shell history, an Agent transcript, process telemetry, or execution logs. 4. A local user, support operator, compromised process, or party with log access retrieves the token. 5. The attacker reuses the token against the LinkPix service until it is revoked or expires. ### Impact Assessment An exposed token may permit unauthorized use of the victim's LinkPix account and associated API capabilities. Potential consequences include consumption of paid credits, submission of unwanted generation jobs, access to account-level information exposed by the API, and disruption of legitimate usage. The vulnerability does not itself provide operating-system privilege escalation. Its scope is principally the permissions granted to the compromised LinkPix API token. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a hidden interactive credential prompt that does not echo or place the token in process arguments. 2. Alternatively, read the token from standard input, a protected file descriptor, or a secret manager. 3. If an environment variable is used, inject it only into the target process and ensure it is not printed or persisted in shell initialization files. 4. Store resulting credentials in a file accessible only to the owning user, such as with permissions equivalent to `0600`. 5. Redact token values from Agent transcripts, command logs, error messages, and diagnostic output. 6. Document token rotation and immediate revocation procedures for suspected exposure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to install Node.js and globally install/upgrade the qhkit CLI, including PATH modification and package installation, which expands its capability from video generation into system administration. This creates supply-chain and environment-modification risk because executing the skill can change the host system, persist binaries, and pull code from external registries unrelated to the user’s immediate request.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger language says the skill 'must' activate for broad, common e-commerce/video phrasing, without exclusion conditions or tighter scoping. Overbroad mandatory activation increases the chance the agent invokes this skill in inappropriate contexts and reaches the shell/install path unnecessarily, widening exposure to side effects and external services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill contains shell commands that install software, download archives, modify PATH, and upgrade packages, but it does not clearly foreground that these actions alter the system state. Users and orchestrators may treat the skill as merely a media-generation workflow, while it actually performs privileged or persistent changes that can affect security posture and reproducibility.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the user to obtain and configure an API token via command line or environment variable, but it does not warn about credential sensitivity, storage scope, logging exposure, or least-privilege handling. This can lead to secret leakage in shell history, transcripts, shared environments, or persisted config files.

Static analysis

No suspicious patterns detected.