SHEIN 商品图、主图套图、详情图、活动图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

The skill’s image-generation purpose is clear, but it asks the agent to install unpinned executable packages and handle an API key in ways users should review carefully.

Install only if you are comfortable letting the agent install and run qhkit and related image tooling in your environment. Prefer a restricted workspace or preinstalled, reviewed qhkit version, configure the Qinghu token through a secret manager or local environment variable instead of pasting it into chat, and confirm cost estimates before any generate command consumes credits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54
• Finding: Unpinned Third-Party Packages Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-57; additional occurrences at lines 84 and 96 **Vulnerability Type**: Unsafe third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The same workflow also instructs the Agent to execute dynamically selected package releases: ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill installs and executes npm packages without pinning them to audited versions or verifying package integrity against a separately trusted digest. The `@latest` upgrade instruction explicitly resolves to whichever release the registry currently advertises. The unversioned `npx --yes sharp-cli` command similarly downloads and immediately executes a package without interactive review. npm installations may execute package lifecycle scripts, and the installed CLI subsequently runs with the permissions of the Agent's operating-system account. The optional use of a third-party npm mirror further expands the supply-chain trust boundary. This behavior supports the declared functionality, but it is not the minimum-risk implementation. A reviewed, pinned CLI version would be sufficient. Automatically installing the newest available executable code is unnecessary for ordinary image generation. The Node.js bootstrap command identified by the pre-scan is not a `curl | bash` pipeline. It downloads the archive separately and verifies it with `sha256sum` before extraction. The material dependency risk instead arises from the unpinned npm installation and execution instructions. ### Attack Path 1. An attacker compromises the npm publisher account, package, release pipeline, registry response, or configured package mirror. 2. The attacker publishes a malicious version of `@iqinghu/qhkit` or `sharp-cli`, or modifies a package dependency. 3. The A ...[truncated 1254 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` and `sharp-cli` to specific versions that have been reviewed. 2. Remove the automatic `@latest` upgrade instruction. Treat upgrades as an explicit, separately reviewed maintenance operation. 3. Maintain a lockfile or verified package-integrity values from an independently trusted source. 4. Prefer a preinstalled, reviewed CLI supplied by the execution environment instead of installing code during Skill invocation. 5. Avoid global installation where possible. Use an isolated project directory, container, or restricted user account. 6. Disable npm lifecycle scripts with `--ignore-scripts` where the packages can operate without them. 7. Require explicit user approval before downloading or installing executable dependencies. 8. Allow only approved registries and mirrors, and document their trust assumptions. 9. Run downloaded tools with restricted filesystem, network, and environment-variable access. 10. For image compression, prefer an already installed image library rather than downloading and immediately executing an unversioned package through `npx`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:72
• Finding: API Token Is Requested Through Chat and Passed as a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 72-77 **Vulnerability Type**: Insecure secret collection and command-line exposure **Risk Level**: Medium ### Vulnerable Code The Skill instructs the user to send the generated API key to the Agent and then configures it with: ```bash qhkit config set --token API_KEY --env prod ``` It also presents `QHKIT_TOKEN` as an alternative, but does not require the user to set that variable through a private secret-management channel. ### Technical Analysis The API token is necessary to authenticate with the declared image-generation service, but asking the user to disclose it in the conversation exceeds the minimum exposure required. The Agent can use a token that the user configures locally without receiving the secret as conversational content. Passing the token through the `--token` command-line argument can expose it through: - Conversation and Agent execution logs. - Shell history. - Process inspection utilities while the command is running. - Tool-call telemetry or audit records. - Error reports that reproduce command arguments. The Skill states that `qhkit config show` returns a redacted configuration, but that does not protect the original chat message or command invocation. The reviewed instructions also do not specify restrictive permissions for any configuration file in which the CLI stores the token. ### Attack Path 1. The user follows the Skill instructions and sends the API token in the conversation. 2. The Agent inserts the token into the `qhkit config set --token ...` command. 3. The token is retained in chat logs, tool-call records, shell history, process arguments, telemetry, or CLI configuration. 4. A party with access to any of those records extracts the token. 5. The exposed token is reused against the Qinghu service. 6. The attacker performs operations allowed by the token, potentially including paid image-generation requests. ### Impact Assessment The direct scope ...[truncated 560 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API tokens into the conversation. 2. Instruct users to configure `QHKIT_TOKEN` directly in their local terminal, platform secret store, or Agent runtime secret manager. 3. Avoid command-line secret arguments. Prefer environment injection, protected standard input, or a secret-file descriptor that is not logged. 4. If a configuration file is required, create it with restrictive user-only permissions and document its location and retention behavior. 5. Ensure Agent and tool telemetry redact secret environment variables and arguments. 6. Avoid echoing full commands containing credentials in errors or status messages. 7. Recommend short-lived, narrowly scoped tokens where supported. 8. Document immediate token revocation and rotation procedures for tokens previously sent through chat or exposed in logs. 9. After configuration, validate only token presence and service connectivity; never display the token itself. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to bootstrap its environment by downloading and installing Node.js, globally installing npm packages, switching registries, and executing shell commands. That exceeds the core image-generation purpose and creates a supply-chain and arbitrary-command execution risk, especially because the agent may perform network downloads and package installation based solely on documentation instructions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to install Pillow via pip or use sharp-cli via npx, then transform local files with ad hoc commands. This expands the attack surface to additional package ecosystems and enables execution of extra tooling on local inputs, which is unnecessary and risky in an agent context handling untrusted files.

Static analysis

No suspicious patterns detected.