AI视频音频提取 | 提取背景音乐 | 人声提取 | 视频转音频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:19 AM UTC
• Version: 0.1.6

Overview

The skill does what it claims, but it asks the agent to install a global third-party CLI and have the user send a production API key through chat, which needs review before use.

Install only if you are comfortable reviewing and approving the external tools first. Prefer a local or sandboxed install, pin the qhkit version when possible, avoid alternate registries unless you trust them, and do not paste API tokens into chat; configure a least-privilege, revocable token locally and rotate it after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Unpinned Global Installation of a Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Supply-chain exposure through an unpinned, globally installed dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com ``` The documentation directs the agent to install `@iqinghu/qhkit` globally when the command is unavailable. It also recommends an alternative package registry if the official source is slow or unavailable. ### Technical Analysis The dependency is installed without a fixed version or integrity validation. Consequently, the package content executed during future installations may differ from the content reviewed when this skill was audited. Global npm installation also expands the potential effect beyond the project directory by placing executable components in a system- or user-wide location. npm packages can execute lifecycle scripts during installation and subsequently run arbitrary package code when their commands are invoked. If the package, one of its transitive dependencies, its publisher account, or the selected registry were compromised, installation could execute attacker-controlled code with the privileges of the user running npm. The alternate registry introduces an additional supply-chain trust boundary. This audit found no evidence that the named package or registry is currently malicious; the vulnerability is the unsafe dependency acquisition and execution process. ### Attack Path 1. An attacker compromises the package publisher, a transitive dependency, or a configured package registry. 2. The attacker publishes or serves a malicious package release under the expected package name. 3. A user invokes the skill on a system where `qhkit` is not installed. 4. The documented unpinned global installation command retrieves the current package version. 5. Malicious npm lifecycle code executes during inst ...[truncated 729 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a specifically reviewed version rather than installing the latest mutable release. - Prefer a project-local installation over `npm i -g` so the dependency remains isolated to the task. - Use a lockfile and verify package integrity hashes before installation. - Review the package and its transitive dependencies before permitting execution. - Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup operations. - Avoid automatically switching to an alternate registry. If a mirror is necessary, require an explicitly approved registry with provenance and integrity controls. - Run dependency installation and media processing in a restricted container or sandbox with minimal filesystem, network, and credential access. - Do not run the installation command with administrator or root privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: API Token Exposure Through Chat and Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Insecure handling of an API credential **Risk Level**: Medium ### Vulnerable Code Snippet ```bash qhkit config set --token <API_KEY> --env prod ``` The same instruction tells the user to create an API key on the provider's dashboard and send that key to the agent. ### Technical Analysis The workflow encourages disclosure of a production API token through the conversation and then supplies the secret directly as a command-line argument. Secrets shared in a conversation may be retained in session transcripts, service logs, debugging records, or other telemetry. Secrets passed on a command line may additionally be captured in shell history, process-monitoring output, audit logs, or command-execution telemetry. The resulting exposure is broader than necessary for configuring the tool. The instruction does not prescribe secure secret entry, redaction, minimum token scope, protected storage, expiration, or revocation after use. No hardcoded credential was present in the audited file, and the audit does not establish that a token has already been disclosed. The issue is the documented credential-handling procedure. ### Attack Path 1. The user creates a production API token as directed. 2. The user sends the token to the agent through the conversation. 3. The agent inserts the token into the documented command-line argument. 4. The credential is recorded in one or more locations, such as conversation history, execution logs, shell history, process inspection output, or telemetry. 5. A party with access to one of those records obtains the token. 6. The exposed token is reused against the provider's API until it expires or is revoked. ### Impact Assessment An attacker who obtains the token may perform API operations authorized by that credential, consume the associated quota, access account-linked API resources, or create billa ...[truncated 303 chars]
• Remediation: ## Remediation Suggestions - Never instruct users to paste API tokens into a conversation. - Configure credentials through an interactive hidden prompt, standard input, an operating-system secret store, or another mechanism that does not expose the value in command-line arguments. - If environment variables are supported, inject them only at execution time and ensure they are excluded from logs and diagnostic output. - Add explicit redaction controls for conversation transcripts, command logs, errors, and telemetry. - Request a narrowly scoped, short-lived token rather than a broadly privileged production credential. - Store configuration files with restrictive permissions and document where the CLI persists its token. - Provide clear token rotation and revocation instructions, especially if a credential was previously shared in chat or entered on a command line. - Ensure commands and examples use placeholders only and never echo the actual secret.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs on-the-fly global installation of a package and asks for credential configuration without first requiring explicit user consent, warning about system modification, or defining safe secret-handling boundaries. In this context, that can lead to unauthorized environment changes, supply-chain exposure from installing external code, and unsafe collection or handling of API tokens.

Static analysis

No suspicious patterns detected.