Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed TikTok Shop image-generation integration, with normal setup and API-key handling for that purpose.
Install this only if you are comfortable using the Qinghu/qhkit service, uploading product images to it, and providing or storing an API key. Prefer pinned or reviewed package versions in controlled environments, and confirm credit-consuming generate actions before they run.
This manifest description says the skill 'must trigger' whenever a user asks for TikTok Shop product images or related assets, and also lists many loose keywords such as '种草' and '病毒营销'. Those terms are broad enough to overlap with general marketing conversations, and the file does not provide negative examples or explicit limits to prevent unintended invocation.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which allows the latest package version to be fetched and executed at runtime. That creates a supply-chain risk: a compromised upstream package, malicious publication, or unexpected breaking change could result in arbitrary code execution in the agent environment.
The same installation block encourages session-persistent toolchain changes by unpacking software into the user's home directory and exporting a new PATH entry. In a skill context that may process adversarial prompts and external packages, persistence makes any upstream compromise or misconfiguration more durable and harder to audit.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The same installation block encourages session-persistent toolchain changes by unpacking software into the user's home directory and exporting a new PATH entry. In a skill context that may process adversarial prompts and external packages, persistence makes any upstream compromise or misconfiguration more durable and harder to audit.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instruction says to relay the message to the user verbatim and notes that it is already user-facing Chinese. This creates a language constraint in user-facing behavior without opt-in or an alternative locale choice, which can violate language/locale policy for users who are not expecting Chinese responses.
The command npx --yes sharp-cli executes an unpinned package directly from the registry during remediation flow. Because this path is specifically recommended when handling oversized user images, it increases the chance of executing unreviewed third-party code on attacker-controlled inputs and makes the supply-chain exposure part of normal skill operation.
The '何时触发' section gives example requests and a broad condition about adapting to the platform's size, composition, or copy layout, but it does not define non-trigger cases. Without explicit boundaries, ordinary discussion of TikTok creative strategy could be mistaken for a request to invoke the skill.