Seedream 5.0 Lite 生成电商图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill is coherent for AI image generation, but it asks the agent to collect an API key through chat and uses broad unpinned install flows that deserve review before use.

Review this before installing. Use a platform secret store, environment variable, or local command you run yourself for the qhkit token instead of pasting an API key into chat. Prefer pinned, reviewed versions of qhkit and image-processing tools, avoid sudo/global installs where possible, and only allow the skill to upload images and submit paid generation jobs after you confirm the exact parameters and credit cost.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57
• Finding: Unpinned Global Installation and Execution of the qhkit Package## Vulnerability Details **File Location**: `SKILL.md`, lines 57–83 **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit on-demand execution through `npx` and later direct installation of the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to globally install `@iqinghu/qhkit` without an exact version or independently verified integrity value. It also recommends upgrading to `@latest` and permits execution through `npx`. These installation methods resolve package contents dynamically at execution time, meaning the code executed by the Agent can differ from the code available when the Skill was audited. Global installation broadens the effect of a dependency compromise because the package and its executable are placed in a user-wide or system-wide command location. If installation is performed with elevated permissions, the package lifecycle scripts could execute with those elevated privileges. Even without elevation, package code runs with the Agent user's access to local files, environment variables, network resources, and configured credentials. Registry mirror fallback further increases the number of supply-chain trust points. No evidence shows that the named package or mirrors are currently malicious; the vulnerability is the lack of immutable version and integrity controls. ### Attack Path 1. An attacker compromises the package maintainer account, package registry, mirror, or a transitive dependency. 2. The attacker publishes a malicious version under the legitimate package name or causes mutable package resolution to return compromised content. 3. The Agent follows the Skill's bootstrap or upgrade instructions and runs the unpinned global installation, `@latest` installation, or `npx` execution. 4. Packa ...[truncated 1160 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed exact version rather than using an implicit current release or `@latest`. 2. Record and verify the expected npm integrity digest before installation. 3. Use a lockfile or equivalent mechanism to pin the complete transitive dependency tree. 4. Remove automatic upgrade instructions. Require explicit review before changing the installed version. 5. Avoid global installation. Install the package in a dedicated, non-privileged project directory or isolated container. 6. Do not run package installation with `sudo`, administrator rights, or an account holding unrelated secrets. 7. Replace unrestricted `npx` execution with a pinned package version and integrity-verified local executable. 8. Prefer the canonical registry. If a mirror is necessary, require a trusted mirror and verify package integrity against metadata obtained through an independent trusted channel. 9. Run the image-generation client with access limited to only the input files and credentials required for the current task.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:96
• Finding: Dynamic Installation and Execution of Unpinned Image-Processing Packages## Vulnerability Details **File Location**: `SKILL.md`, line 96 **Vulnerability Type**: Unpinned third-party dependency installation and immediate execution **Risk Level**: Medium ### Vulnerable Code ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis When an image exceeds the service limit, the Skill instructs the Agent to install Pillow from a package mirror or immediately retrieve and execute `sharp-cli` using `npx --yes`. Neither dependency is pinned to an exact reviewed version, and no package hash, signature, or lockfile is required. `npx --yes` is particularly sensitive because it automatically approves package retrieval and execution. The executed package may include installation scripts and transitive dependencies whose content can change after this Skill has been reviewed. The alternate Python path has the same mutable dependency problem and adds a non-default package index as another supply-chain trust point. Image compression is legitimate and relevant to the declared functionality, but dynamically installing executable packages is broader than the minimum privilege needed. A preinstalled, pinned, sandboxed image-processing utility would achieve the same goal with less supply-chain exposure. No evidence indicates that Pillow, `sharp-cli`, or the specified package mirror is malicious. The issue is unsafe, mutable dependency resolution and immediate execution. ### Attack Path 1. An attacker compromises the package publisher, npm or Python package infrastructure, the configured mirror, or a transitive dependency. 2. A user supplies an image larger than 10 MB, activating the compression workflow. 3. If Pillow is unavailable, the Agent follows the Skill and installs an unpinned package from the mirror. Alternatively, it invokes unpinned `sharp-cli` through `npx --yes`. 4. Compro ...[truncated 880 chars]
• Remediation: ## Remediation Suggestions 1. Use a preinstalled image-processing component with a reviewed, exact version. 2. If installation is unavoidable, pin Pillow and `sharp-cli` to exact versions and verify package hashes or signatures. 3. Lock all transitive dependencies and retain reviewed lockfiles with the Skill. 4. Remove `npx --yes`; do not automatically approve retrieval and execution of unresolved package versions. 5. Install dependencies in a disposable virtual environment or isolated container rather than the global user environment. 6. Run compression in a sandbox with access limited to the source image and output directory, with no access to unrelated credentials or home-directory files. 7. Restrict outbound network access during image decoding and compression. 8. Prefer a canonical package source. When a mirror is required, validate artifacts against integrity information obtained independently from the mirror. 9. Treat input images as untrusted and keep the selected image-processing library patched against decoder vulnerabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly tells the agent to ask the user to send an API key in chat and then configure it locally. Requesting secrets directly through the conversation creates an unnecessary credential-exposure path, increases the chance of logging or retention in chat transcripts, and violates basic secret-handling hygiene for a routine image-generation skill.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Instructing the agent to solicit an API key directly from the user in chat is a clear secret-handling vulnerability. Secrets shared in chat may be stored in logs, exposed to other tools, or mishandled by the agent, and the skill's stated purpose does not justify collecting credentials through conversational text.

Static analysis

No suspicious patterns detected.