Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent for using Qinghu/LinkPix video generation, with expected media uploads, API-key setup, and dependency installation disclosed to the user.
Install only if you are comfortable giving qhkit a Qinghu API key and uploading the referenced videos or product images to that service. Prefer a preinstalled or pinned qhkit version, review any generated script before spending credits, and use a scoped or revocable API key when possible.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning an exact package version. That permits whatever version is latest at execution time to be fetched and run, creating supply-chain risk and making behavior non-reproducible if the upstream package is compromised or changes unexpectedly.
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and prepending it to PATH, with guidance to make the change survive across commands. Persistent environment mutation is risky because it changes the host for future tasks and can enable unintended execution of newly installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and prepending it to PATH, with guidance to make the change survive across commands. Persistent environment mutation is risky because it changes the host for future tasks and can enable unintended execution of newly installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
L076 instructs the agent that CLI messages are already user-facing Chinese and says to relay them directly to the user. This imposes a specific language on user-facing output without offering language choice or documenting a justified locale constraint.
The command npx --yes sharp-cli pulls and executes an unpinned package from the registry at runtime. If the package or one of its dependencies is malicious or compromised, the agent may execute attacker-controlled code on the host during image processing.