Vidu Q2 爆款视频复刻 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:20 AM UTC
• Version: 0.1.1

Overview

The skill mostly matches its video-generation purpose, but it asks users to paste an API key into chat and uses broad, mutable install and command patterns that deserve review before use.

Review before installing. Prefer setting QHKIT_TOKEN through a protected local secret mechanism instead of chat, pin and locally install qhkit where possible, avoid automatic @latest upgrades, and sanitize or rename uploaded media files before running the compression examples.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45–74 **Vulnerability Type**: Unsafe third-party dependency installation and execution **Risk Level**: Medium ### Technical Analysis The Skill directs the Agent to install and execute the `@iqinghu/qhkit` package without pinning it to an audited version or integrity value: ```bash npm i -g @iqinghu/qhkit ``` It also provides an `npx` fallback that can retrieve and immediately execute the current package version: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly installs the mutable `latest` release: ```bash npm i -g @iqinghu/qhkit@latest ``` These commands allow package contents to change after the Skill has been reviewed. Global installation also modifies the Agent user's shared executable environment instead of using a task-scoped dependency directory. The optional use of an npm mirror expands the set of infrastructure that must be trusted. The `qhkit` dependency is necessary for the declared video-generation functionality, but global installation and execution of an unpinned release exceed the minimum required scope. A project-local, version-pinned installation would provide the required capability with less supply-chain and cross-session risk. The flagged Node.js pipeline is not a `curl | bash` operation. It downloads a fixed Node.js archive and verifies it against the vendor's checksum manifest before extraction: ```bash cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" ``` That specific pipeline validates data rather than executing downloaded shell code and is therefore not classified as a confirmed remote-payload vulnerability. ### Attack Path 1. An attacker compromises the npm publis ...[truncated 1079 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific reviewed version rather than using an unconstrained package or `@latest`. 2. Record and verify package integrity using a lockfile and npm integrity metadata. 3. Install the package into a task-specific or project-local directory instead of the global executable environment. 4. Invoke the pinned local binary, such as through `npm exec --package=@iqinghu/qhkit@<approved-version>`. 5. Disable lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@<approved-version> ``` 6. Permit upgrades only after explicit review of the new version and its provenance. 7. Restrict registries to an approved allowlist and avoid automatically switching to mirrors without equivalent integrity and provenance controls. 8. Run the CLI in a sandbox with access limited to the media files required for the current task and inject API credentials through a protected secret mechanism. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:87
• Finding: Shell and Python Code Injection Through Unsafely Substituted Filenames<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 87 **Vulnerability Type**: Command injection through untrusted file paths **Risk Level**: High ### Technical Analysis The oversized-image handling instructions tell the Agent to substitute source and destination filenames directly into shell commands: ```bash python -c "from PIL import Image, ImageOps; im=ImageOps.exif_transpose(Image.open('原图')); im.thumbnail((2048,2048)); im.convert('RGB').save('压缩后.jpg', quality=85)" ``` The source filename is embedded inside a Python string literal that is itself embedded inside a shell argument. A filename containing quotes or crafted Python syntax can terminate the intended string and alter the program supplied to `python -c`. The Node.js fallback also uses filenames as unquoted shell arguments: ```bash npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` Spaces, shell metacharacters, command substitutions, redirections, or option-like filenames can change how the shell or utility interprets this command. The use of `npx --yes` additionally retrieves and executes an unpinned package without an interactive approval step. Uploaded media filenames can be attacker-controlled. Image content does not need to exploit an image decoder if the filename itself is copied into these command templates. ### Attack Path 1. An attacker supplies an image larger than 10 MB so that the documented local compression procedure is triggered. 2. The uploaded image uses a crafted filename containing shell metacharacters, command substitution syntax, quotes, or Python syntax. 3. The Agent replaces the placeholder in the documented command with the filename without robust argument handling. 4. The shell parses injected syntax in the `sharp-cli` command, or Python executes injected statements from the modified `python -c` program. 5. The injected command runs under the Agent user's account. For example, a filename containing a single quote can escape the `Image.open('... ...[truncated 692 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate filenames into `python -c` source code. 2. Pass filenames as positional arguments and read them from `sys.argv`, for example: ```bash python compress_image.py --input "$INPUT_PATH" --output "$OUTPUT_PATH" ``` 3. Implement `compress_image.py` as a reviewed local script using a structured argument parser. 4. Invoke processes through an API that accepts an argument array without a shell, such as Python `subprocess.run([...], shell=False)`. 5. If shell use is unavoidable, quote every path robustly and insert `--` before positional filename arguments where supported. 6. Generate output filenames internally rather than deriving shell syntax from user-controlled names. 7. Resolve and validate paths, reject traversal outside an approved working directory, and process uploads under randomized safe local filenames. 8. Pin `sharp-cli` and Pillow to reviewed versions with integrity controls rather than using `npx --yes` or an unpinned `pip install`. 9. Run media conversion in a sandbox with no access to unrelated files, secrets, or unrestricted network resources. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send their API key in chat, then use it to run `qhkit config set --token <密钥> --env prod`. Collecting secrets through normal chat exposes credentials to conversation logs, downstream systems, and unintended viewers, and creates unnecessary secret-handling risk.

Static analysis

No suspicious patterns detected.