Seedance 2.5 电商带货视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill matches its video-generation purpose, but needs review because it asks for an API key in chat and automatically installs or upgrades unpinned tools.

Review before installing. Use this only if you trust the qhkit/Qinghu service and are comfortable uploading product media to it. Do not paste API keys into chat; configure credentials through a protected local secret mechanism if available. Prefer preinstalling reviewed tool versions in an isolated environment, and approve any paid generation only after checking the estimate and submitted parameters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49
• Finding: Execution of Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49-55`, `SKILL.md:76-79`, and `SKILL.md:89` **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: Medium ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` The instructions also permit execution through `npx @iqinghu/qhkit <command> ...` when global installation fails. ### Technical Analysis The Skill directs the Agent to install and execute packages without pinning exact versions or verifying package integrity. In particular, `@latest`, `npx`, and unversioned `pip install` operations resolve package contents at execution time. The code that executes can therefore differ from the code available when the Skill was audited. NPM installation may execute package lifecycle scripts. Both `npx` and `npx --yes` can download and immediately run executable packages without a separate review step. Python package installation can likewise execute build-system code or package setup logic. Use of alternative registries and mirrors further expands the set of infrastructure that must be trusted. Global installation of `@iqinghu/qhkit` is broader than necessary for a single video-generation task. It modifies the user-level or system-level Node.js environment and may affect later projects or sessions. The separately flagged Node.js checksum command at `SKILL.md:60` is not itself a `curl | bash` execution pattern: ```bash cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It sends checksum data to `sha256sum`, not to a shell, and the instructions require successful verification before extraction. The primary supply-chain risk comes from the subsequently installed, unpinned packages. ### Attack Path 1. A ...[truncated 1500 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version, for example: ```bash npm install --no-save --ignore-scripts @iqinghu/qhkit@<reviewed-version> python -m pip install pillow==<reviewed-version> ``` 2. Record and verify package integrity hashes. Use an NPM lockfile with integrity metadata and Python hashes through `pip --require-hashes`. 3. Remove `@latest` and avoid automatic upgrades in response to remote messages. Present upgrade information to the user and require explicit approval. 4. Avoid `npx --yes` because it combines download and execution without review. Install reviewed packages into a dedicated, isolated environment first. 5. Prefer a project-local installation, temporary container, virtual environment, or other sandbox instead of global installation. 6. Disable package lifecycle scripts where compatible, and review any scripts that must remain enabled. 7. Restrict registry use to explicitly approved sources. Do not silently switch to a mirror. 8. Require informed user approval before installing software or changing the global environment. 9. Run dependency tools with restricted filesystem and network access and without unrelated credentials in the environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68
• Finding: API Token Exposure Through Chat and Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:68-73` **Vulnerability Type**: Insecure secret collection and command-line token handling **Risk Level**: Medium ### Complete Code Snippet ```text 3. 点「创建/复制」生成密钥，生成后将 API 密钥发我 ``` ```bash qhkit config set --token <密钥> --env prod ``` The first instruction tells the user to create or copy an API key and send that API key to the Agent. ### Technical Analysis The Skill asks the user to disclose an API token directly through the conversation. This is unnecessary for the declared video-generation functionality because the user could configure the token locally without exposing it to the Agent or conversation transcript. Secrets supplied through chat may be retained in conversation history, telemetry, debugging records, audit logs, or downstream processing systems. The suggested `--token` command-line argument introduces additional exposure because command arguments may appear in shell history, command execution logs, process inspection tools, or Agent tool-call records. Although the Skill mentions `QHKIT_TOKEN` as an alternative, it does not prioritize a secure secret-entry mechanism and explicitly instructs the user to send the key through chat. ### Attack Path 1. The user follows the Skill instructions and pastes the production Qinghu API token into the conversation. 2. The token is stored or propagated through chat history, Agent logs, telemetry, or execution records. 3. Alternatively, the Agent places the token in the `qhkit config set --token ...` command line, exposing it through process arguments or shell history. 4. A person or service with access to any affected log, history, transcript, or process listing retrieves the token. 5. The exposed token is used to authenticate to the Qinghu API. 6. The attacker submits unauthorized generation jobs or otherwise consumes resources permitted by the token until it is revoked. ### Impact Assessment The likely privilege scope is the Qinghu accou ...[truncated 540 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction asking the user to send the API key through chat. 2. Direct the user to configure the token locally through an approved secret manager or protected environment variable. 3. Prefer hidden interactive input that does not echo or persist the token. 4. Avoid passing secrets as command-line arguments. The CLI should read the token from standard input, a protected credential store, or an environment variable supplied by the runtime's secret-injection facility. 5. If a configuration file is necessary, create it with restrictive permissions and document its location and retention policy. 6. Ensure the CLI, Agent, and surrounding platform redact authorization headers, environment variables, configuration output, and token-shaped values from logs. 7. Use narrowly scoped and short-lived tokens where the service supports them. 8. Provide explicit token-revocation and rotation instructions for users who previously disclosed a key in chat or command history. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to bootstrap the environment by installing Node.js, globally installing/upgrading qhkit, and using alternate package mirrors. That materially expands the skill from video generation into host modification and software supply-chain activity, increasing risk of unintended system changes, persistence, and exposure to malicious or compromised packages or mirrors.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to solicit an API key from the user and then set it via CLI or environment variable. This expands the skill into credential collection and handling, creating unnecessary exposure of secrets in chat history, logs, shell history, process listings, or tool traces, and increases the blast radius if the agent or environment is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill tells the agent to install additional tooling such as Pillow or sharp-cli and to transform local user files to work around size limits. This broadens scope from video generation to arbitrary local file processing and ad hoc dependency installation, which can introduce supply-chain risk, modify user data, and create privacy issues around local media handling.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description says the skill must trigger for a very broad set of common e-commerce and product-video requests. Overbroad mandatory triggers can cause the skill to activate in unrelated contexts, increasing the chance that users are steered into this tool unexpectedly and that its installation, credential, or spending flows are invoked without clear intent.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: The trigger section provides only positive examples and lacks boundaries for when not to activate. This can lead to accidental invocation in adjacent workflows, which becomes more risky here because the skill can proceed into package installation, authentication setup, and billable task submission.

Static analysis

No suspicious patterns detected.