Vidu Q2 电商带货视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.1

Overview

The skill matches its video-generation purpose, but it asks users to expose an API key in chat and directs agents to install or run mutable third-party packages with broad local effects.

Review before installing. Use a dedicated or sandboxed environment, prefer pinned package versions, avoid automatic @latest upgrades, and do not paste a raw API key into chat if your platform has a secret manager or masked credential prompt. Expect uploaded product media and prompts to be sent to the Qinghu/qhkit service, and confirm costs before any generate action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51
• Finding: Unpinned CLI installation permits mutable third-party code execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 51–54 and 77–79 **Vulnerability Type**: Unpinned executable dependency installation **Risk Level**: Medium ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit transient execution through: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` Both npm installation paths may be redirected to: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The skill installs and executes `@iqinghu/qhkit` without pinning an exact version or verifying the downloaded package's integrity against a review-time hash. The `@latest` upgrade command is explicitly mutable, while an unversioned `npm install` or `npx` invocation resolves according to the package registry state at execution time. npm packages may execute lifecycle scripts during installation and then operate with the privileges of the agent process. Consequently, compromise of the publisher account, registry infrastructure, mirror, package release process, or a newly published package version could turn these instructions into arbitrary code execution. Use of the npm mirror as a fallback adds another supply-chain trust boundary. No evidence establishes that the named package or mirror is currently malicious, so this finding concerns unsafe dependency acquisition rather than a confirmed malicious payload. The installation is relevant to the declared video-generation functionality, but global installation and automatic installation or upgrading exceed the minimum necessary privilege. A locally pinned installation with explicit user approval would be sufficient. ### Attack Path 1. An attacker compromises the npm publisher account, release process, registry response, or fallback mirror. 2. The attacker publishes or serves a modified version under the expected package name or ` ...[truncated 1012 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an unversioned package or `@latest`. 2. Commit a lockfile containing npm integrity metadata and install with `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. 3. If lifecycle scripts are required, audit them and document why before allowing their execution. 4. Prefer a project-local installation over `npm install -g`; invoke the pinned binary from `node_modules/.bin`. 5. Do not automatically upgrade in response to remote error messages. Present the proposed version and obtain explicit user approval. 6. Verify package provenance using npm signatures or attestations where available, and validate the package tarball against a trusted, review-time SHA-512 digest. 7. Avoid transparently changing registries. If a mirror is necessary, require explicit user approval and apply the same integrity and provenance validation. 8. Run the CLI in a restricted environment with access only to the required media files and API endpoint. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:90
• Finding: On-demand image tooling installs and executes unpinned packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 90 **Vulnerability Type**: Unpinned runtime dependency retrieval and execution **Risk Level**: Medium ### Complete Code Snippet ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` The alternative path invokes an automatically downloaded npm package: ```bash npx --yes sharp-cli -i INPUT_IMAGE -o OUTPUT_IMAGE.jpg resize 2048 ``` The instructions also permit adding the npm mirror option: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis When an image exceeds the service limit, the skill directs the agent to install Pillow from an alternate Python package index or execute `sharp-cli` through `npx --yes`. Neither dependency is pinned to a reviewed version or verified using a trusted hash. `npx --yes` suppresses the normal installation confirmation and immediately executes the resolved package. Python package installation can also execute package build or installation logic. A compromised package, publisher, package index, mirror, or dependency can therefore execute code in the agent environment. Image compression is necessary for the declared workflow, but dynamically installing mutable packages without informed approval is not the least-privileged implementation. A preinstalled and pinned image-processing component, sandboxed conversion service, or built-in media tool would reduce this risk. ### Attack Path 1. An attacker compromises the `Pillow` or `sharp-cli` distribution chain, one of their transitive dependencies, or the configured package index or mirror. 2. The user supplies an image larger than 10 MB, activating the automatic compression branch. 3. The agent installs the unpinned Python package or runs the unpinned npm package with confirmation disabled. 4. Malicious installation logic or package code executes with the agent's privileges. 5. The payload can access files, credentials, media, and network resources available to tha ...[truncated 504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use exact reviewed versions, such as an exact Pillow and `sharp-cli` release, rather than resolving the current registry version. 2. Require hashes for Python packages and dependencies, using a locked requirements file with `--require-hashes`. 3. Use an npm lockfile with integrity metadata instead of invoking `npx --yes` against a mutable registry package. 4. Install image tools in a dedicated virtual environment or isolated container rather than modifying the agent's shared environment. 5. Obtain explicit user approval before downloading and executing additional software. 6. Prefer a preinstalled, reviewed image converter and disable unnecessary network access during conversion. 7. Treat image input as untrusted and process it with resource, filesystem, and network restrictions because image decoders also have their own vulnerability surface. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: API credential is requested through the conversation and passed on the command line<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–70 **Vulnerability Type**: Insecure secret collection and handling **Risk Level**: Medium ### Complete Code Snippet ```bash qhkit config set --token <API_KEY> --env prod ``` The same section permits configuration through: ```bash QHKIT_TOKEN ``` It instructs the user to create or copy the API key and send the key to the agent. ### Technical Analysis The skill asks the user to disclose an API credential directly in the conversation. Conversation content may be retained in transcripts, logs, telemetry, debugging systems, or model context and may be exposed to users or services with access to those records. The recommended command-line form also places the token in a process argument. Depending on the shell and operating system, that value may be recorded in shell history, command audit logs, terminal capture, or process inspection output. An environment variable avoids some command-line exposure but may still be inherited by child processes or captured in diagnostics. The CLI legitimately requires authentication for the declared service. However, collecting the raw secret in chat and interpolating it into a command is broader exposure than necessary. Authentication should use a secure secret-input channel that does not reveal the value to the conversation or command line. ### Attack Path 1. The user follows the skill's setup guidance and sends the raw API key in the conversation. 2. The key becomes part of the conversation history and may also be included in platform logs, traces, or support exports. 3. The agent executes the documented configuration command, potentially placing the key in shell history, process arguments, or execution logs. 4. A party with access to any of these records recovers the token. 5. The party uses the token against the Qinghu API until it expires or is revoked. ### Impact Assessment The attacker could perform operations authorized by the exposed API ...[truncated 440 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never ask the user to paste a raw API key into the conversation. 2. Use a platform-provided secret manager or masked credential prompt whose value is not added to model context, transcripts, or telemetry. 3. Prefer an interactive configuration command that reads the token from standard input without echoing it. 4. Avoid passing secrets as command-line arguments. If environment-based configuration is unavoidable, scope the variable to only the required process and remove it immediately afterward. 5. Ensure execution logs redact tokens and authorization headers. 6. Store credentials using operating-system credential storage or an encrypted configuration mechanism with restrictive filesystem permissions. 7. Use narrowly scoped, short-lived tokens where the service supports them. 8. If a key has already been sent through chat or exposed in a command, revoke and rotate it and remove it from accessible logs where possible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill’s trigger scope is excessively broad because it includes common commerce and video-generation terms alongside brand/model identifiers, increasing the chance the agent invokes this skill for loosely related requests. Unintended activation can route users into unnecessary third-party tooling, causing confusion, possible unwanted data sharing, and accidental task execution paths.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The instructions are written to default responses and operational messaging in Chinese, including user-facing guidance and error handling, without first confirming the user’s preferred language. This can degrade informed consent around billing, setup, and task submission, especially because the skill requires explicit approval before generating chargeable jobs.

Static analysis

No suspicious patterns detected.