AI视频去水印 | 去水印 | 去除水印 | 视频水印移除 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.5

Overview

The skill matches its advertised video-watermark removal purpose, but its automatic global CLI install and latest-version upgrade path create review-worthy supply-chain and persistence risk.

Install only if you trust the qhkit npm package and service, are comfortable uploading the selected videos, and can manage the API token carefully. Prefer a contained or local install over global npm, avoid automatic latest upgrades without review, and process only media you own or are authorized to modify.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:36
• Finding: Automatic Installation and Execution of Unpinned npm Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:36`, `SKILL.md:39`, and `SKILL.md:56` **Vulnerability Type**: Supply-chain exposure through mutable third-party dependencies **Risk Level**: High ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The fallback instructions also permit direct execution through `npx`: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly retrieves the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning an audited version or package integrity value. It also directs the Agent to upgrade to the mutable `latest` release in response to version messages produced by the installed CLI. An npm installation can execute package lifecycle scripts, while subsequent CLI invocations execute the package's local code. Therefore, the effective executable payload is controlled by whichever package version the registry resolves at installation time, rather than by code contained in the reviewed Skill. Global installation unnecessarily broadens the modification scope compared with a project-local or isolated installation. The reviewed repository contains only `SKILL.md`; it does not contain the npm package implementation or a lockfile. Consequently, the package's runtime behavior, upload destinations, lifecycle scripts, and integrity cannot be established from the audited artifact. There is no evidence that the current package is malicious, but the installation design creates a concrete supply-chain trust boundary and unsafe automatic-update path. The documented Node archive flow is not a `curl | bash` pattern. It downloads an archive and checks it with `sha256sum` before extraction. That flow does not constitute direct remote-script execution, although using a fallback mirror for both the archive and checksum provides weaker provenance than verification against an in ...[truncated 1445 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than an implicit current version or `@latest`. 2. Use a lockfile and enforce the expected npm integrity hash. Verify package provenance before execution. 3. Remove automatic upgrade instructions based solely on messages emitted by the installed CLI. Require explicit review and approval of each new version. 4. Prefer a project-local, temporary, or sandboxed installation over `npm i -g`. 5. Run the dependency under a dedicated low-privilege account or isolated container with access only to the media selected for processing. 6. Restrict filesystem and network access to the minimum destinations and files required for the operation. 7. Consider disabling npm lifecycle scripts where compatible, for example with `--ignore-scripts`, and separately verify that the package does not depend on them. 8. Document the exact expected service endpoints and package publisher identity so unexpected network destinations or ownership changes can be rejected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:50` **Vulnerability Type**: Plaintext secret exposure in process arguments and command records **Risk Level**: Medium ### Vulnerable Code Snippet ```bash qhkit config set --token <secret> --env prod ``` ### Technical Analysis The Skill instructs the user or Agent to provide the API token directly as a command-line argument. Command-line secrets may be exposed through process inspection, shell history, terminal capture, debugging output, Agent execution logs, telemetry, or orchestration records. The alternative `QHKIT_TOKEN` environment variable can reduce shell-history exposure but is not a complete secret-management solution. Environment variables may still be inherited by child processes, recorded in diagnostic output, or exposed through process and container inspection depending on the execution environment. The documentation states that `qhkit config show` returns redacted configuration, but the audited artifact does not establish how `qhkit config set` stores the token or what permissions are applied to the resulting configuration file. ### Attack Path 1. A user obtains an API token and follows the documented command. 2. The plaintext token becomes part of the command arguments and may be retained in shell history, Agent logs, terminal records, or process-monitoring data. 3. A local user, monitoring process, logging system, or party with access to those records retrieves the token. 4. The attacker reuses the token against the associated service. 5. The attacker performs any operations authorized by the token, potentially consuming account credits or submitting unauthorized processing requests. ### Impact Assessment The exposure is limited to the permissions granted to the compromised API token; it does not directly provide operating-system privilege escalation. Depending on service-side authorization, compromise may enable unauthorized API use, account-credit consumption, submission o ...[truncated 231 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the command-line token argument with hidden interactive input or protected standard input. 2. Store the token in an operating-system credential manager or a dedicated secret store rather than ordinary shell history or plaintext configuration. 3. If file-based storage is unavoidable, create the file with restrictive permissions, such as owner-only read and write access, and document its exact location. 4. Ensure the Agent, shell, and orchestration layer redact tokens from commands, logs, traces, errors, and telemetry. 5. Disable command-history recording for the token-entry operation and avoid placing secrets in reusable scripts. 6. Use narrowly scoped, short-lived tokens where the service supports them, and provide clear rotation and revocation procedures. 7. Verify and document that `qhkit config show`, failure messages, and diagnostic output never reveal the complete token. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger scope is overly broad and explicitly mandates activation whenever users mention common terms like video watermark removal, logo removal, or corner-mark cleanup. In practice this can cause the agent to invoke a watermark-removal skill in ambiguous contexts without first checking ownership, authorization, or lawful purpose, increasing the chance of facilitating copyright circumvention or misuse.

Static analysis

No suspicious patterns detected.