Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for generating storyboards, but it gives agents broad setup authority to install/update tools and configure tokens on the user's machine.
Install only if you are comfortable with qhkit being installed or updated on your machine and with a qhkit token being configured for the service. Prefer a controlled environment with Node/qhkit already installed, avoid unpinned npx/latest execution where possible, and provide credentials only through a method you can revoke or remove.
The manifest says the skill 'must trigger' whenever a user asks to write a storyboard, create storyboard images, or mentions terms like 'storyboard' and '拍摄脚本'. This combines a mandatory activation rule with a broad keyword list and no exclusion conditions, making it unclear when the skill should not activate.
The natural-language description is entirely prescriptive in Chinese and states mandatory triggering behavior for Chinese-language storyboard requests, without offering any language or locale choice. Under the policy, forcing a specific language or locale without user opt-in is a violation unless clearly justified as region-specific and documented as such.
The skill goes well beyond storyboard generation by directing the agent to install Node.js, install packages globally, and bootstrap missing tooling. This expands the execution and trust boundary from content generation into environment modification, increasing attack surface and the chance of unnecessary code execution on the host.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever version is current at execution time to be fetched and run. In a skill context, this creates a supply-chain risk and reduces reproducibility, especially because the package is then used to process user inputs and credentials.
This duplicate finding refers to the same persistence behavior: extracting binaries into a user directory and altering PATH for subsequent command resolution. In a content-generation skill, such environment mutation is unnecessary and materially broadens the consequences of any mistake or supply-chain compromise.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding refers to the same persistence behavior: extracting binaries into a user directory and altering PATH for subsequent command resolution. In a content-generation skill, such environment mutation is unnecessary and materially broadens the consequences of any mistake or supply-chain compromise.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs persistent credential configuration via qhkit config set --token <密钥> and environment-variable manipulation, which exceeds the minimum needed for one storyboard task. In an agent setting, this can cause long-lived secret storage or modification of host configuration, creating credential-handling and persistence risks.