淘宝天猫 商品图、主图套图、详情图、活动图生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

This skill mostly matches its image-generation purpose, but it asks users to share an API key in chat and installs mutable third-party tooling globally.

Review this before installing. Use it only if you are comfortable sending product images and prompts to the Qinghu/qhkit service, and do not paste API keys into chat. Prefer a protected secret store or local environment variable, use revocable scoped tokens, and consider running the CLI in a contained environment with pinned dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54
• Finding: Unpinned Third-Party Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 54-57; related update and fallback instructions at lines 80 and 93 **Vulnerability Type**: Supply-chain exposure through mutable, globally installed, and automatically executed dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` Related commands: ```bash npm i -g @iqinghu/qhkit@latest pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill directs the agent to install `@iqinghu/qhkit` globally without pinning an exact version or integrity value. It also explicitly instructs the agent to upgrade to `@latest`, meaning the code executed at runtime can differ from the version assessed during this audit. The `npx --yes sharp-cli` fallback downloads and executes a package without interactive confirmation or an exact version. Package installation can execute package lifecycle scripts, while the installed CLI subsequently runs with all permissions available to the agent's operating-system account. The use of additional package mirrors expands the set of infrastructure that must be trusted. There is no evidence that any named package or registry is currently malicious; the vulnerability is the unsafe dependency acquisition and execution model. ### Attack Path 1. An attacker compromises a package maintainer account, package release process, registry, or configured mirror. 2. The attacker publishes a malicious release under one of the dependency names used by the Skill. 3. The agent follows the bootstrap, upgrade, or image-compression instructions. 4. The package manager resolves the mutable dependency and downloads the compromised release. 5. Malicious lifecycle scripts or CLI code execute under the agent user's privileges. 6. The payload can access files, credentials, network resources, and processes ...[truncated 568 chars]
• Remediation: ## Remediation Suggestions - Pin every dependency to a reviewed exact version rather than using an unconstrained package name or `@latest`. - Verify package integrity using a lockfile, trusted checksums, or registry integrity metadata. - Remove automatic upgrade instructions. Require a separate review before changing the approved version. - Avoid global installation. Run the CLI in a dedicated container, sandbox, or minimally privileged project environment. - Replace `npx --yes` with a pinned, pre-approved dependency installed from a lockfile. - Restrict installation to explicitly approved registries and avoid automatic mirror fallback. - Disable package lifecycle scripts where feasible and validate that required packages function under that restriction. - Limit filesystem and network access available to dependency processes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: API Token May Be Exposed Through Chat and Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 69 **Vulnerability Type**: Insecure secret collection and command-line credential handling **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <API_KEY> --env prod ``` The surrounding instructions direct the user to send the API key to the agent before this command is executed. ### Technical Analysis Requesting an API key through an agent conversation can cause the secret to be retained in conversation history, telemetry, debugging records, or other transcript storage. Supplying the token directly as a command-line argument can additionally disclose it through shell history, process inspection, command auditing, or execution logs, depending on the runtime environment. The document mentions `QHKIT_TOKEN` as an alternative, but it does not require protected secret injection or warn against exposing the token in chat and command arguments. Environment variables can also leak through diagnostics or child processes unless the execution environment handles them as protected secrets. ### Attack Path 1. The user follows the Skill's instructions and sends an API token in the conversation. 2. The agent inserts the token into the documented command-line argument. 3. The token is retained in a transcript, shell history, process record, audit log, or diagnostic output. 4. A person or process with access to one of those records retrieves the token. 5. The exposed token is used to access the associated Qinghu API account and submit tasks. This path depends on the surrounding platform's transcript retention, logging, and process-isolation controls; exposure is not guaranteed in every environment. ### Impact Assessment A recovered token could permit unauthorized use of the associated API account, including submission of paid generation tasks and consumption of account credits. It may also expose account configuration or generated content t ...[truncated 163 chars]
• Remediation: ## Remediation Suggestions - Do not ask users to paste API tokens into an ordinary conversation. - Use a platform-provided secret-entry interface or protected credential store. - Prefer a masked interactive prompt or secure standard-input mechanism instead of a command-line argument. - Ensure secret values are redacted from transcripts, telemetry, command traces, errors, and diagnostic output. - If environment injection is used, mark the variable as secret, prevent logging, and remove it immediately after execution. - Store persistent credentials with restrictive file permissions and document where the CLI saves them. - Use narrowly scoped and revocable tokens where supported. - Provide token rotation and revocation guidance for suspected disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation text is extremely broad and mandates triggering on many common e-commerce image requests, which can cause the agent to over-select this skill for requests that should remain in a safer, more general workflow. Over-broad activation increases the chance of unnecessary third-party uploads, tool execution, and credential collection under ambiguous user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger section lacks boundaries and negative examples, so ordinary image-generation requests may be routed into this external-service skill without sufficient justification. In context, that matters because this skill can upload files and drive external tooling, so misrouting has real privacy and operational consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to upload user images to an external service and retrieve results, but it does not disclose that user-provided media will leave the local environment. This is a meaningful privacy/transparency gap, especially for commercial product imagery that may include unreleased assets, branding, or embedded sensitive metadata.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instructions tell the user to send an API key back in chat for the agent to configure, which normalizes sharing secrets through an untrusted conversational channel. That creates a direct credential-exposure risk: the key may be stored in transcripts, logs, analytics systems, or visible to parties beyond the intended execution environment.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This is a direct secret-handling anti-pattern: the skill explicitly asks the agent to solicit an API key from the user and then apply it. In the context of an externally connected image-generation tool, compromise of that key could enable unauthorized API usage, billing abuse, and access to the user’s service account.

Static analysis

No suspicious patterns detected.