Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Temu product-image helper, but users should notice that it installs and updates external CLI dependencies and stores an API token for a paid image service.
Before installing, confirm you are comfortable using qhkit from npm and sending product images plus an iqinghu API key to the service. Prefer a reviewed or pinned qhkit version when possible, avoid permanent PATH/profile edits unless you need them, and check the estimated credits before approving any generation task.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning an exact version. That allows the fetched package to change over time, so a compromised upstream release or dependency could execute arbitrary code at runtime on the host.
The same installation block recommends extracting binaries into a user-controlled directory and adjusting PATH, which creates session persistence and may influence later command resolution. In an agent setting, persistence is more dangerous because future unrelated tasks may inherit the modified toolchain and execute unexpected binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The same installation block recommends extracting binaries into a user-controlled directory and adjusting PATH, which creates session persistence and may influence later command resolution. In an agent setting, persistence is more dangerous because future unrelated tasks may inherit the modified toolchain and execute unexpected binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The prescribed user-facing onboarding text and instructions are entirely in Chinese and direct the agent to send that exact guidance to the user. There is no opt-in or alternative for users who may prefer another language, which creates a language-policy issue under the natural-language policy rules.
The skill falls back to npx --yes sharp-cli, which downloads and executes the latest package version on demand. Because this is an image-processing helper invoked automatically during remediation, it expands the attack surface to arbitrary upstream package changes and possible supply-chain compromise.