AI视频去字幕 | 消除字幕 | 去除字幕 | 视频无字幕 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:20 AM UTC
• Version: 0.1.5

Overview

This skill does what it claims, but it asks the agent to install and upgrade a mutable global CLI and to follow an external tool's upgrade message as a command.

Review before installing. Use only with videos you are comfortable uploading to LinkPix/qhkit, avoid sensitive or confidential footage unless you trust that service, and prefer a pinned, task-scoped install with explicit approval before any install or upgrade command is run.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:40
• Finding: Unpinned Third-Party Package Is Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40–42 and 58–61 **Vulnerability Type**: Unpinned dependency installation and mutable supply-chain execution **Risk Level**: High ### Vulnerable Code Snippets ```bash npm i -g @iqinghu/qhkit ``` The instructions also recommend installing the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` A third-party registry mirror may be selected with: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the agent to install `@iqinghu/qhkit` without pinning an audited version or validating package integrity. The `@latest` upgrade command explicitly selects a mutable release whose contents may change after this Skill has been reviewed. An npm installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Therefore, installing the package is not merely downloading a CLI: it can execute code with the privileges of the account running npm. Global installation also exposes the resulting executable broadly within that user's environment and exceeds the narrower scope of a temporary, task-specific installation. Using a fallback registry increases the number of supply-chain systems that must be trusted. The Skill does not require verification that the mirror returns the same package integrity metadata as the expected official release. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, package dependencies, or configured registry. 2. The attacker publishes a malicious version under the expected package name or modifies a transitive dependency. 3. The agent follows the Skill and runs the unpinned global installation or the `@latest` upgrade command. 4. npm downloads the attacker-controlled release and may execute its lifecycle scripts during installation. 5. The malicious code runs with the privileges of the agent's operating-system account. 6. The installed ...[truncated 820 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically audited version rather than using an unversioned package name or `@latest`. 2. Record and verify npm integrity metadata or a trusted package digest before installation. 3. Remove the instruction to install upgrades merely because the package reports that an upgrade is available. 4. Require explicit user approval before installing or upgrading executable dependencies. 5. Prefer a task-scoped local installation in an isolated directory or container instead of a global installation. 6. Disable lifecycle scripts with `--ignore-scripts` if the package functions correctly without them. If scripts are required, audit those scripts and all relevant dependencies first. 7. Use the official npm registry by default. Treat registry fallback as an explicit trust decision and verify that the package digest matches the expected official artifact. 8. Execute the CLI as an unprivileged user with filesystem and network access restricted to the input video, output location, and required service endpoints. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:55
• Finding: External CLI Output Is Treated as Trusted Execution Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–58 **Vulnerability Type**: Trusting attacker-influenced tool output as executable instructions **Risk Level**: High ### Vulnerable Instruction The Skill states, translated into English: > If the command returns a version-gate error, the message contains the upgrade command; follow it exactly. It then supplies the expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The instruction establishes that text returned in the CLI's `message` field may be treated as a command and followed exactly. A tool response is data, not a trusted instruction channel. Its contents may be influenced by a compromised local package, a compromised vendor service, a malicious dependency, or manipulated network responses where applicable. Although the documented expected action is an npm upgrade, the instruction does not constrain execution to a fixed command or validate the returned text against an allowlist. Consequently, arbitrary text emitted by the external CLI may supersede the safe, predefined workflow and induce the agent to perform unrelated shell actions. This behavior is not necessary for subtitle removal. Version handling can be implemented with a fixed, reviewed command and explicit user authorization. ### Attack Path 1. An attacker compromises or replaces the `qhkit` package, manipulates a dependency, or compromises the remote service that supplies the CLI's error message. 2. The CLI returns a version-stage response whose `message` contains an attacker-selected shell command instead of a legitimate upgrade instruction. 3. The Skill directs the agent to follow the message exactly. 4. The agent interprets the untrusted message as operational guidance and executes the supplied command. 5. The command runs with the agent user's privileges and can perform actions unrelated to video subtitle removal. ### Impact Assessment The resulting scope depends on the ...[truncated 540 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute or “follow exactly” commands supplied in CLI output. 2. Treat all stdout, stderr, JSON fields, API responses, filenames, URLs, and error messages as untrusted data. 3. Implement a strict allowlist for version handling. For example, recognize only a documented version error code and map it internally to a fixed, pinned installation command. 4. Never pass a returned `message` field directly to a shell or use it to construct shell syntax. 5. Display the message to the user as informational text and obtain explicit authorization before performing an installation or upgrade. 6. Validate the requested package name, version, registry, command arguments, and destination independently of the tool response. 7. Run any approved upgrade in a restricted environment with least-privilege filesystem and network permissions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly states that local video file paths are accepted and that the CLI will automatically upload them to an external service, but it does not require a clear user-facing warning or consent step before transfer. Because videos may contain sensitive personal, biometric, copyrighted, or confidential information, silent off-device upload creates a meaningful privacy and data-governance risk.

Static analysis

No suspicious patterns detected.