TikTok 爆款视频生成 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:20 AM UTC
• Version: 0.1.1

Overview

The skill appears to provide the advertised TikTok video-generation workflow, but it asks the agent to install mutable tools and handle a persistent API key in ways users should review before installing.

Review this skill before installing if you are uncomfortable with an agent installing npm/Python packages, using mirror registries, uploading local media to Qinghu/LinkPix, or storing a Qinghu API token locally. Use a limited API key, rotate it if exposed, confirm costs before generation, and prefer an isolated environment for the CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:48
• Finding: Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48–51, 74–76, and 87 **Vulnerability Type**: Unpinned and insufficiently verified third-party dependencies **Risk Level**: High ### Complete Code Snippets ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to download, install, and execute mutable third-party packages without pinning exact versions or validating package integrity. In particular: - `npm i -g @iqinghu/qhkit` resolves the package version at installation time. - `@latest` explicitly installs whichever release currently owns the mutable `latest` tag. - `npx` can download and immediately execute packages that are not already installed. - `pip install pillow` similarly resolves a mutable package release through a third-party mirror. - No lockfile, package digest, signature, provenance attestation, or independently verified checksum is provided for these dependencies. - Global installation is broader than necessary because it modifies the user's shared Node.js environment rather than an isolated project environment. Package installation can invoke package lifecycle scripts, and package execution grants the package access to the Agent's operating-system privileges. The documented registry mirrors expand the number of infrastructure providers that must be trusted. This behavior is related to the declared functionality because `qhkit` provides the video-generation interface and image-processing tools are used for compression. However, mutable global installation and immediate `npx` execution exceed the minimum privilege and supply-chain exposure necessary to provide that functionality. The separately flagged pipeline at lines 56–57 is not a `cu ...[truncated 1956 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version; do not use `@latest` or other mutable tags. 2. Commit a lockfile containing integrity metadata and install with deterministic commands such as `npm ci`. 3. Install dependencies in a dedicated project directory or isolated container rather than globally. 4. Avoid automatic `npx` downloads. Install a pinned package in advance and execute its local binary. 5. Pin Python packages with hashes and use an isolated virtual environment, for example through a hash-locked requirements file. 6. Use only trusted registries. If a mirror is required, apply the same package-integrity and provenance verification used for the primary registry. 7. Verify package signatures, npm provenance attestations, or independently published digests before execution. 8. Disable lifecycle scripts during installation where the package does not require them, and separately review any scripts that must run. 9. Run media-processing and service CLI dependencies in a sandbox with restricted filesystem access, network access, and environment variables. 10. Prefer an already provisioned, administrator-reviewed runtime instead of allowing a Skill to install executable dependencies dynamically. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63
• Finding: API Token Is Requested Through Conversation and Passed as a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 63–68 **Vulnerability Type**: Insecure secret collection and command-line secret exposure **Risk Level**: High ### Complete Code Snippet ```bash qhkit config set --token <API_KEY> --env prod ``` The surrounding instructions direct the user to create or copy an API key and send that key to the Agent. They also identify `QHKIT_TOKEN` as an alternative environment variable. ### Technical Analysis The Skill asks the user to transmit an API credential through the conversation and then embeds that credential directly in a command-line argument. Secrets submitted through a conversation can be retained in conversation history, telemetry, debugging records, or Agent context. Once available to the Agent, they may also be exposed to tools or dependencies invoked later. Passing the secret as `--token <API_KEY>` creates additional exposure channels. Depending on the operating system and shell environment, command arguments may appear in: - Process listings and process-monitoring interfaces. - Shell history. - Command execution logs. - CI/CD or Agent tool-call logs. - Diagnostic and error output. The alternative environment-variable approach reduces command-line exposure but remains unsafe if the variable is inherited by unnecessary child processes, logged, or made available to untrusted dependencies. Because the same Skill dynamically installs third-party packages, exposing the token within that execution environment materially increases the impact of a dependency compromise. The Skill legitimately requires service authentication, but asking the user to reveal the token in chat and placing it on the command line are not minimum-exposure authentication mechanisms. ### Attack Path 1. The user follows the Skill instructions, generates an API key, and sends it in the conversation. 2. The key becomes part of Agent context and may be retained in conversation or operational logs. 3. The Agent execut ...[truncated 1419 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys into the conversation. 2. Integrate with a platform-provided secret manager or credential-entry interface that prevents the secret from entering Agent-visible context. 3. Use an interactive, non-echoing prompt or protected standard input rather than a command-line argument. 4. If environment injection is necessary, scope the variable to only the trusted process and remove it immediately afterward. 5. Ensure secrets are redacted from tool calls, process output, telemetry, errors, and audit logs. 6. Store credentials in a file or system credential store with permissions restricted to the owning user when persistent storage is required. 7. Do not expose the credential to image-processing tools or unrelated package installation processes. 8. Prefer short-lived, narrowly scoped tokens with explicit credit and API-operation limits. 9. Provide straightforward token rotation and revocation instructions. 10. Add automated secret-redaction tests covering command arguments, configuration output, error messages, and status responses. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to install Node.js and the qhkit package, including fallback mirrors and PATH changes, which expands from using an existing video-generation tool into altering the host environment. This creates supply-chain and environment-integrity risk because the agent may fetch and install software from the network and modify execution context on systems where such changes were not explicitly authorized by the user.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to accept a user API key and persist it via `qhkit config set --token`, modifying local authentication state. Persisting secrets in CLI config increases the chance of credential exposure, reuse across sessions, and unintended access to the user's account from the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill tells the agent to install additional dependencies such as Pillow or sharp-cli and rewrite user image files locally for compression retries. This broadens scope from media generation to arbitrary local file manipulation and ad hoc package installation, increasing risk of damaging user data, mishandling sensitive media, or introducing malicious third-party code.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The metadata says the skill must trigger whenever the user asks for TikTok viral video generation or related ad/marketing short videos, using broad keyword matching. Overbroad activation can cause the agent to invoke this skill in loosely related conversations, leading to unintended tool use, data transfer, or charges without a clear user request for this specific provider workflow.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The '何时触发' section treats generic requests for TikTok videos or any case where the user wants to post to TikTok as sufficient to trigger the skill. In context, this is risky because the skill can upload assets, poll jobs, and incur credits, so ambiguous routing may push users into an external service they did not specifically choose.

Static analysis

No suspicious patterns detected.