Seedream 5.0 Pro 爆款电商图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill matches its advertised image-generation purpose, but it asks for chat-based API key sharing and persistent, mutable tool installation that users should review carefully.

Install only if you trust the qhkit/LinkPix provider and are comfortable with a persistent CLI setup. Prefer setting QHKIT_TOKEN through a local secrets mechanism instead of pasting the API key into chat, review any global npm installs or upgrades before running them, and confirm estimated credit usage before generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57
• Finding: Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 57, 83, and 96 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i input.jpg -o compressed.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to install packages without pinning exact, reviewed versions or verifying package integrity. The `@latest` specifier and `npx --yes` invocation explicitly retrieve and execute whichever package release the registry currently serves. Package installation may also execute lifecycle scripts. The instructions permit alternate npm and Python package mirrors, expanding the supply-chain trust boundary. The global npm installation modifies the user's environment beyond the immediate Skill execution and makes the installed executable available to later sessions. These dependencies are functionally related to image generation and compression, but installing mutable global packages is not the minimum-risk way to provide that functionality. An isolated, version-pinned installation would reduce the required scope. ### Attack Path 1. An attacker compromises a package maintainer account, package release, or configured package registry. 2. A malicious version is published under one of the package names used by the Skill. 3. The Agent follows the bootstrap or upgrade instructions and runs `npm`, `pip`, or `npx`. 4. The package manager downloads the mutable package version. 5. Malicious lifecycle or runtime code executes with the privileges of the Agent process. 6. That code can access files, environment variables, API credentials, and images available to the Agent. ### Impact Assessment Successful exploitation permits arbitrary code execution with the current opera ...[truncated 541 chars]
• Remediation: ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version instead of using unqualified versions or `@latest`. 2. Record and verify package integrity hashes through an npm lockfile, npm integrity metadata, or an equivalent trusted manifest. 3. Replace global installation with a project-local, isolated installation or a restricted container. 4. Avoid automatic `npx --yes` downloads. Install a reviewed `sharp-cli` version in advance and invoke that fixed local binary. 5. Use a dedicated virtual environment and a hash-locked requirements file for Python dependencies. 6. Avoid package lifecycle scripts where compatible with the dependency, such as by using `--ignore-scripts` after confirming functionality. 7. Use one explicitly trusted registry rather than silently switching between multiple registries. 8. Run dependency installation and image processing under a restricted account with no access to unrelated files or secrets. 9. Require explicit user approval before modifying the environment, particularly before global installation or upgrades.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96
• Finding: Unsafe Image Filename Interpolation in Shell Commands## Vulnerability Details **File Location**: `SKILL.md`, line 96 **Vulnerability Type**: Shell and interpreter argument injection **Risk Level**: Medium ### Vulnerable Code The documented compression templates are equivalent to: ```bash python -c "from PIL import Image, ImageOps; im=ImageOps.exif_transpose(Image.open('input-image')); im.thumbnail((2048,2048)); im.convert('RGB').save('compressed-image.jpg', quality=85)" ``` ```bash npx --yes sharp-cli -i input-image -o compressed-image.jpg resize 2048 ``` The Skill instructs the Agent to replace the input and output placeholders with actual file paths. ### Technical Analysis The Python command places a substituted file path inside a quoted Python expression that is itself embedded in a shell command. A path containing a quote, backslash, command substitution, or shell metacharacter can break the intended quoting boundaries. The `npx` template similarly shows unquoted paths and does not use a safe argument-array execution mechanism. Whitespace and shell metacharacters can therefore alter command parsing. Option-like filenames may also be interpreted as command-line options where the invoked tool supports such parsing. The risk depends on the Agent performing direct textual substitution as instructed. Safe process APIs that pass each argument separately would prevent shell metacharacters from being interpreted. ### Attack Path 1. An attacker supplies an image larger than 10 MB with a crafted filename or causes such a path to be used. 2. The Skill triggers its mandatory local compression fallback. 3. The Agent inserts the attacker-controlled path directly into the documented Python or `npx` command. 4. The shell, Python interpreter, or command-line parser interprets part of the filename as syntax rather than as a literal path. 5. Injected syntax performs an unintended command or redirects image processing to an unintended file. 6. The resulting operation runs w ...[truncated 587 chars]
• Remediation: ## Remediation Suggestions 1. Do not substitute filenames into `python -c` source code. 2. Place compression logic in a fixed, reviewed script and pass input and output paths as positional arguments read through `sys.argv`. 3. Invoke processes through an argument-array API with shell processing disabled. 4. Quote paths defensively where shell invocation cannot be avoided, while recognizing that argument arrays are preferable. 5. Use `--` before file operands where supported to prevent option-like filenames from being parsed as flags. 6. Generate the output path internally in a dedicated temporary directory instead of accepting an arbitrary output path. 7. Validate that the input is a regular image file and reject symbolic links or unexpected path types where appropriate. 8. Constrain processing to approved working directories and run it with minimal filesystem permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill metadata says it 'must trigger' for very broad image-generation requests and lists many generic e-commerce/art generation keywords. In an agent-routing context, this can cause overbroad invocation, misroute unrelated user requests into this third-party tool flow, and unnecessarily steer users toward external installation, configuration, and paid API usage.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The '何时触发' examples include common commercial-image scenarios like product hero images and posters without strict boundaries. This increases the chance that normal image requests are captured by this skill even when the user did not ask for this vendor or workflow, which can lead to unnecessary external-tool execution and cost-incurring steps.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send an API key in chat and then apply it via command-line configuration. Collecting secrets through conversational channels increases the risk of credential exposure in logs, transcripts, model context, telemetry, or accidental reuse by the agent, making this a direct secret-handling vulnerability.

Static analysis

No suspicious patterns detected.