AI视频角色替换 | 换人 | 人物替换 | 角色换脸 | 模特换脸 | LinkPix

• Outcome: Review
• Latest audit: Oct 16, 2026 · 3:50 AM UTC
• Version: 0.1.6

Overview

The skill’s video face-swap purpose is clear, but it also tells the agent to install and update runtime software in persistent user locations without tight user-controlled scoping.

Review before installing. Use this only if you are comfortable uploading the video and reference image to the qhkit/LinkPix service, have authorization for any real person’s likeness, and are willing to let the agent install or update Node/qhkit. Prefer a preinstalled, pinned qhkit binary and explicit confirmation before any global install, PATH change, token storage, or package upgrade.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: linkpix-video-role-swap
description: 上传原视频及新角色图，一键替换原视频中的人物角色，动作口型保持不变。当用户要求换视频里的人、视频换脸、角色替换、数字人替换、模特视频本地化时必须触发。关键词：LinkPix、qhkit、角色替换、视频换人、视频换脸、人物替换、数字人替换、模特替换、视频本地化。
user-invocable: true
homepage: https://www.npmjs.com/package/@iqinghu/qhkit
metadata: {"openclaw":{"emoji":"🧑‍🎤","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger language is overly broad and says the skill 'must' activate for common phrases like video face swap or localization-related requests. Broad matching can cause accidental invocation in unrelated contexts, pushing the agent into executing external tooling and handling sensitive media when the user may not have intended to use this specific skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation goes well beyond describing how to use a role-swap feature and tells the agent to install Node, install npm packages globally, change PATH, and bootstrap missing dependencies. That expands the skill's effective privileges from media processing into software installation and environment modification, increasing the attack surface and enabling unintended code execution paths.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed in the agent environment without review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This duplicate finding identifies the same persistent installation behavior: unpacking Node into a user-owned library path and exporting it into command search paths. In skill context, that is dangerous because a media-editing skill should not be changing the host runtime state in ways that survive beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This duplicate finding identifies the same persistent installation behavior: unpacking Node into a user-owned library path and exporting it into command search paths. In skill context, that is dangerous because a media-editing skill should not be changing the host runtime state in ways that survive beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text