Security audit

视频号爆款视频生成 | LinkPix

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed video-generation workflow that installs and uses qhkit to create WeChat Channels marketing videos, with confirmation required before credit-spending generation.

Before installing, be aware that the skill can install qhkit and possibly Node, save or use a qhkit API token, upload referenced media files to the provider, and spend credits only after confirmation. Review the listed model, files, duration, orientation, language, and estimated credits before approving generation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The metadata description says the skill 'must trigger' whenever a user asks for 视频号爆款视频生成 or related ad/promotional short videos, which creates a broad mandatory routing rule. This can cause the agent to invoke a cost-incurring external tool for loosely related requests, reducing user control and increasing the chance of unintended uploads, task creation, or billing.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The '何时触发' section uses short, ambiguous phrases such as '做视频号爆款视频 / 带货视频 / 种草视频 / 投放视频' and '明确要发视频号' without clear boundaries or negative examples. In an agent setting, this can over-match ordinary creative discussions and prematurely steer users into an external generation flow that may upload files and spend credits.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.