Security audit
Security checks for vulnerabilities and agentic risk
The skill’s video-generation purpose is coherent, but it asks the agent to install and update unpinned command-line tools and store service credentials, which deserves review before use.
Install this only in an environment where you are comfortable letting the agent install or update npm/Node tooling, store a qhkit API token, and upload reference videos or product images to the qhkit/iqinghu service. Prefer a disposable workspace, preinstall a reviewed qhkit version yourself if possible, avoid sensitive media, and verify the quoted credit cost before approving any generate command.
The manifest description says the skill "must" trigger on a long keyword list including broad terms like "抖音", "TikTok", "小红书", "种草视频", and "短视频起号". These terms are common topic words rather than narrowly scoped invocation phrases, so they could cause unintended activation during ordinary discussion of social-media marketing.
The "何时触发" section gives examples such as using Seedance 2.0 to recreate a viral video, but it does not define negative cases or clearly separate this skill from adjacent tasks like generic video generation, analysis, or platform discussion. That ambiguity increases the risk of this skill being invoked outside its intended clone/recreation workflow.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which permits execution of whatever package version is current at install time. That creates a supply-chain risk: a compromised latest release or dependency could be fetched and executed in the agent environment, especially because the command is framed as a fallback path for missing tooling.
This duplicate finding points to the same persistence behavior: unpacking Node.js into a user-controlled directory and exporting a modified PATH. In a skill that may execute automatically, persistent tooling bootstrap increases the blast radius of mistakes or future package compromise because later sessions may inherit the installed runtime.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node.js into a user-controlled directory and exporting a modified PATH. In a skill that may execute automatically, persistent tooling bootstrap increases the blast radius of mistakes or future package compromise because later sessions may inherit the installed runtime.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions state that the CLI message is already user-facing Chinese and should be relayed directly to the user. This implies a fixed language behavior rather than offering the user a language choice, which can violate language/locale policy when users have not opted into Chinese output.
The fallback image-compression command uses npx --yes sharp-cli with no pinned version, causing an on-demand download and execution of the latest package. In an automated agent workflow, this widens the attack surface to npm supply-chain compromise and makes builds non-reproducible.