Security audit
Security checks for vulnerabilities and agentic risk
The skill has a legitimate image-generation purpose, but it asks the agent to install and run mutable third-party tooling and make persistent environment or credential changes that users should review first.
Review this skill before installing if you do not want an agent to install Node/npm tools, run unpinned npm packages, store a qhkit API token, upload product images to QinghuAI/qhkit services, or spend account credits after confirmation. Prefer a preinstalled, pinned qhkit version and avoid persistent PATH or shell-profile changes unless you intentionally want them.
The description uses mandatory activation language for a very broad class of common e-commerce image requests, increasing the chance the agent invokes this skill even when another safer or more appropriate path exists. In this skill, over-triggering is more dangerous because invocation can lead to environment setup, package installation, credential handling, and external API use.
The invocation guidance lists broad examples but lacks clear boundaries and negative cases, which can cause the agent to over-select this skill for ambiguous requests. Given the skill's ability to install software, set persistent configuration, and process uploaded files, accidental invocation expands the attack surface and may trigger unnecessary sensitive operations.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning an exact version, which allows whatever package version is current at execution time to run with the agent's privileges. This creates a supply-chain risk: a compromised upstream package, malicious publish, or breaking update could lead to arbitrary code execution or unsafe behavior during tool bootstrap.
This duplicate finding points to the same persistent bootstrap behavior: installing Node under the user's home directory and altering PATH, with guidance to make the change survive across shells. In an agent context, persistent environment modification is risky because it outlives the session and may affect later commands, skills, or users in ways that are hard to audit.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistent bootstrap behavior: installing Node under the user's home directory and altering PATH, with guidance to make the change survive across shells. In an agent context, persistent environment modification is risky because it outlives the session and may affect later commands, skills, or users in ways that are hard to audit.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The fallback image-compression path executes npx --yes sharp-cli with no pinned version, causing on-demand download and execution of the latest published package. Because this path is triggered automatically on oversized images, it can silently introduce arbitrary third-party code execution through a mutable upstream dependency.