AI视频角色替换 | 换人 | 人物替换 | 角色换脸 | 模特换脸 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.5

Overview

This skill has a coherent video role-replacement purpose, but it gives the agent broad install and upgrade authority, including executing an upgrade command taken directly from tool output.

Install only in a sandbox or controlled environment, pin and review qhkit before use, require explicit approval for installs or upgrades, and do not execute command text returned by the CLI. Use it only with media and likenesses the user is authorized to process, and treat QHKIT_TOKEN and uploaded videos/images as sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–42 and line 60 **Vulnerability Type**: Unpinned dependency installation and unsafe supply-chain execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to install and execute a mutable third-party npm package without specifying an exact audited version, lockfile, or integrity value. The `@latest` command explicitly selects whichever release is current at execution time. The `npx` fallback can download and immediately execute the package. npm installation may run package lifecycle scripts. A compromised package version, maintainer account, registry, or configured mirror could therefore introduce arbitrary executable code. Global installation also modifies the user's npm installation prefix and exposes the package to subsequent sessions, which exceeds the minimum necessary scope compared with an isolated, version-pinned installation. The reviewed project does not contain the package implementation, so the behavior ultimately executed by these commands cannot be established from the Skill itself. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the registry, or a distribution mirror. 2. The attacker publishes a malicious version of `@iqinghu/qhkit`. 3. The Agent follows the Skill and runs the unpinned install, `@latest` upgrade, or `npx` command. 4. npm downloads the attacker-controlled release. 5. Malicious lifecycle scripts or CLI code execute with the permissions of the Agent's operating-system account. 6. The malicious package can access resources available to that account, including supplied media, the configured service token, and other user-readable files. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the Age ...[truncated 485 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact, reviewed version rather than using an unresolved version or `@latest`. 2. Record and verify npm integrity metadata for the approved package artifact. 3. Remove automatic `@latest` upgrades. Require explicit user approval and security review before changing versions. 4. Prefer an isolated project-local installation with a lockfile over global installation. 5. Avoid `npx` downloads that immediately execute unresolved packages. If `npx` is unavoidable, specify an exact version and use an approved registry. 6. Disable npm lifecycle scripts with `--ignore-scripts` where the package remains functional without them. 7. Run the dependency in a sandbox with access limited to the selected media, required network endpoints, and a narrowly scoped service token. 8. Do not expose unrelated files, credentials, or environment variables to the CLI process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:57
• Finding: Blind Execution of Upgrade Commands Supplied Through CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Dynamic command execution from an untrusted output channel **Risk Level**: High ### Vulnerable Instruction The instruction states that when the CLI returns a version-stage error, the response message contains the upgrade command and the Agent should execute that command directly: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; follow it directly. ``` ### Technical Analysis This instruction treats text returned by the installed CLI or its remote backend as an authority for local command execution. It does not require an allowlist, command parsing, validation, fixed command mapping, or user confirmation. CLI output is data and should not be interpreted as trusted shell instructions. If the package, service backend, package update mechanism, or another component influencing the returned message is compromised, an attacker can place arbitrary shell syntax in the upgrade message. Following that message directly creates a command-injection and remote-command execution path. This behavior is not necessary for the declared video role-replacement functionality. Version handling can instead map a recognized status value to a hard-coded, version-pinned update operation. ### Attack Path 1. An attacker compromises the `qhkit` package or a backend response used by the CLI. 2. The compromised component returns an error with `stage` set to `version`. 3. The `message` field contains an attacker-selected command instead of a legitimate upgrade command. 4. The Agent follows the Skill instruction and executes the message without validation. 5. The command runs with the privileges and environment of the Agent user. 6. The attacker can read or alter accessible data, steal the configured token, execute additional payloads, or establish user-level persistence. ### Impact Assessment Exploitation could result in arbitra ...[truncated 546 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute command text returned in the CLI `message` field. 2. Treat all stdout, stderr, service responses, and error messages as untrusted data. 3. Map a recognized `stage: "version"` response to a hard-coded update workflow rather than evaluating returned text. 4. Pin the permitted target version and package source. 5. Require explicit user approval before performing any package installation or upgrade. 6. Invoke package-management tools with structured argument arrays rather than passing dynamically constructed strings to a shell. 7. Reject messages containing shell metacharacters, URLs outside an allowlist, redirections, pipelines, command substitutions, or unrelated executables. 8. Perform upgrades in an isolated environment with least-privilege filesystem, credential, and network access. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger text is explicitly mandatory and broadly covers common user intents like replacing a person in a video, which increases the chance of unintended or automatic invocation without sufficient contextual checks. In this skill, that is more dangerous because the capability performs face/role replacement on real people, so accidental triggering can bypass normal consent, policy, or user-clarification steps.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: linkpix-video-role-swap
description: 上传原视频及新角色图，一键替换原视频中的人物角色，动作口型保持不变。当用户要求换视频里的人、视频换脸、角色替换、数字人替换、模特视频本地化时必须触发。关键词：LinkPix、qhkit、角色替换、视频换人、视频换脸、人物替换、数字人替换、模特替换、视频本地化。
user-invocable: true
homepage: https://www.npmjs.com/package/@iqinghu/qhkit
metadata: {"openclaw":{"emoji":"🧑‍🎤","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}}

• Confidence: 88% confidence
• Finding: The manifest metadata combines aggressive trigger language ('must trigger') with installation and execution guidance for an external CLI, which is consistent with tool/metadata poisoning risk. In context, this can steer an agent into automatically installing packages, fetching binaries, or handling sensitive media and API tokens based on manifest instructions instead of applying independent trust and safety checks.

Static analysis

No suspicious patterns detected.