AI视频分镜 | 分镜图生成 | 镜头设计 | 运镜方案 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.6

Overview

The skill’s storyboard purpose is coherent, but it asks the agent to install and upgrade mutable third-party tooling and to run an upgrade command taken from CLI output.

Review this skill before installing. It appears intended for legitimate LinkPix storyboard generation, but only use it if you are comfortable installing qhkit, providing a QHKIT_TOKEN, and uploading selected media to that service. Do not run upgrade commands copied from CLI output unless you verify the exact command, package, registry, and version yourself.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:40
• Finding: Execution of Unpinned Third-Party npm Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40–43 and 58–61 **Vulnerability Type**: Unpinned dependency installation and execution **Risk Level**: High ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also permit direct execution through an unpinned package name: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs or executes `@iqinghu/qhkit` without pinning it to a reviewed version or verifying package integrity. Both the unversioned package reference and the `@latest` tag are mutable: the code retrieved during a future invocation can differ from the code that existed when this Skill was audited. npm installation can execute package lifecycle scripts, while `npx` can download and immediately run package code. Consequently, compromise of the publisher account, npm package, registry infrastructure, or configured mirror could introduce arbitrary executable code. The mirror fallback further expands the supply-chain trust boundary. No lockfile, integrity digest, package signature, or isolated execution environment is specified. ### Attack Path 1. An attacker compromises the package publisher, an authorized release process, or a trusted registry endpoint. 2. The attacker publishes a malicious version of `@iqinghu/qhkit` or causes the mutable package reference to resolve to malicious content. 3. The Agent follows the Skill instructions and runs `npm i -g`, `npm i -g ...@latest`, or `npx`. 4. npm downloads the altered package and potentially runs its lifecycle scripts. 5. The malicious package executes with the privileges of the Agent process. 6. It can access files, environment variables, network resources, and credentials available to that account. ### Impact Assessment Successful exploitation provides arbitrary code execution under the ...[truncated 552 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an unversioned reference or `@latest`. 2. Verify the package against a trusted integrity digest before installation. 3. Remove the instruction to execute the package directly through unpinned `npx`. 4. Use a lockfile and a project-local installation rather than a global installation. 5. Disable unnecessary lifecycle scripts during installation, for example with `npm install --ignore-scripts`, if the package functions without them. 6. Run the CLI in a restricted container or sandbox with access only to explicitly selected media files. 7. Require explicit user approval before installing or upgrading third-party software. 8. Pin and authenticate the registry source; do not silently switch to a mirror. 9. Review each new package version before updating the pinned version. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Execution of Upgrade Commands Supplied Through Remotely Influenced CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Unvalidated remote command execution guidance **Risk Level**: High ### Vulnerable Instruction English rendering of the audited instruction: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as instructed. ``` ### Technical Analysis The Skill tells the Agent to treat the `message` field returned by the CLI as an executable upgrade command. The content of this field can be influenced by the installed CLI package or its remote service. There is no allowlist, parser, fixed command template, version validation, or user-confirmation requirement. This creates a code-execution channel in which text originating outside the reviewed Skill can determine a local shell command after the Skill has been published. This behavior exceeds what is necessary to support upgrades. A secure implementation can detect a version error and invoke a locally defined, pinned upgrade procedure without executing returned text. ### Attack Path 1. An attacker compromises the `qhkit` package, its backend service, or a response path that controls the CLI's `message` field. 2. The attacker returns a version-stage error containing a malicious shell command instead of a legitimate upgrade command. 3. The Agent follows the Skill instruction to execute the command from the message. 4. The shell runs the attacker-controlled command locally. 5. The command obtains the same filesystem, environment, and network access as the Agent process. ### Impact Assessment Successful exploitation can result in arbitrary command execution with the privileges of the Agent user. This can permit: - Theft of API tokens and environment variables - Reading or modification of user-accessible files - Exfiltration of local media or generated content - Download and execution of additional payloads - Modification of user-level shell configuration or ins ...[truncated 234 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute any command contained in CLI output. 2. Treat all `message`, standard output, and standard error content as untrusted data for display only. 3. Replace remotely supplied commands with a hard-coded, version-pinned upgrade procedure. 4. Validate any suggested version against a strict semantic-version pattern and an explicit allowlist. 5. Require user confirmation before every installation or upgrade. 6. Execute upgrades in a restricted environment with minimal filesystem and credential access. 7. Log the proposed package name, version, registry, and integrity digest before installation. 8. Reject responses containing shell metacharacters, URLs, redirections, pipelines, command substitutions, or additional commands; validation should supplement rather than replace the prohibition on executing returned text. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill metadata explicitly says storyboard-related requests 'must trigger', which creates an overly broad activation rule that can preempt normal intent resolution and route many common creative requests into this tool without meaningful exclusions. In context, this is not direct code execution abuse, but it can cause inappropriate tool invocation, unnecessary installation/configuration flows, and increased exposure to external services and user data.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The description is written as a mandatory Chinese-language behavioral rule and does not offer language selection or justify a locale restriction. In context this is mainly a safety/quality and user-control issue rather than a severe security flaw, but it can mis-handle user intent, reduce transparency, and increase the chance of the agent following rigid skill instructions over the user's preferred language or workflow.

Static analysis

No suspicious patterns detected.