Vidu Q3 爆款视频复刻 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.1

Overview

This skill performs a coherent Qinghu/Vidu video workflow, but it asks users to share an API key in chat and relies on mutable runtime tool installs and unsafe media-path command examples.

Review this skill before installing. Use it only in an isolated workspace, avoid pasting long-lived API keys into chat, prefer a managed secret or temporary limited token if available, verify exact package versions before installing or upgrading qhkit, and be careful with media files or filenames from untrusted sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52
• Finding: Runtime Installation and Execution of Mutable Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-55`, `SKILL.md:78-80`, and `SKILL.md:91` **Vulnerability Type**: Supply-chain exposure through unpinned runtime dependencies **Risk Level**: High ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```text The default source is the official npm registry. If it is slow or unavailable, add: --registry=https://registry.npmmirror.com If global installation fails because of permissions and privilege elevation is unavailable, use: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i <input-path> -o <output-path>.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to install and execute packages dynamically from npm and Python package registries. The primary package is installed without an exact version, while the upgrade procedure explicitly requests `@latest`. The image-compression fallback similarly installs or executes mutable versions of Pillow and `sharp-cli`. These packages and their transitive dependencies are not included in the audited project. Their executable content can therefore change independently after this Skill has been reviewed. Use of alternate mirrors creates additional infrastructure that must be trusted. The `npx --yes` command is particularly sensitive because it can download and execute a package without an interactive confirmation. The global installation of `@iqinghu/qhkit` also has broader scope than is strictly necessary for a single Skill invocation. Although the instructions do not explicitly require root access, a global package can modify shared executable locations when the current account has sufficient permissions. The checksum operation at `SKILL.md:61` is not a `curl | bash` execution. It pipes a remotely retrieved checksum manifest through `grep` and `sha256sum`, and the archive is only extracted after v ...[truncated 1181 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every package to a reviewed, exact version rather than using unversioned packages or `@latest`. 2. Verify package integrity with lockfiles, npm integrity metadata, hashes, or signed release artifacts. 3. Remove automatic upgrades based solely on CLI or server-provided messages. Require explicit user approval after displaying the exact target version and source. 4. Avoid global installations. Install dependencies in a dedicated, unprivileged project directory or isolated container. 5. Replace `npx --yes` with a preinstalled, version-pinned utility. 6. Use one trusted registry wherever possible. If a mirror is required, document its trust assumptions and verify fetched artifacts against hashes obtained through an independent trusted channel. 7. Disable unnecessary package lifecycle scripts during installation where compatible, and review required scripts before enabling them. 8. Run external media tooling in a sandbox with limited filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:91
• Finding: Command and Python-Code Injection Through Unescaped Media Paths<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:91` **Vulnerability Type**: Unsafe interpolation of file paths into shell commands and inline Python source **Risk Level**: High ### Complete Code Snippet ```bash python -c "from PIL import Image, ImageOps; im=ImageOps.exif_transpose(Image.open('原图')); im.thumbnail((2048,2048)); im.convert('RGB').save('压缩后.jpg', quality=85)" ``` ```bash npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` ### Technical Analysis The instructions tell the Agent to replace path placeholders directly inside shell commands. The Python variant places the input and output paths inside single-quoted Python string literals that are themselves embedded in a double-quoted shell argument. A path containing a single quote can terminate the Python string and inject additional Python expressions or statements. The `sharp-cli` fallback presents input and output paths without shell quoting. Spaces can split a path into multiple arguments, while shell metacharacters such as semicolons, command substitutions, redirections, or ampersands can change command behavior when interpreted by a shell. Media filenames and paths may originate from user uploads, downloaded resources, or attacker-controlled archives. Treating those paths as trusted command text creates a local code-execution boundary. ### Attack Path 1. An attacker supplies an oversized media file with a crafted filename or causes the Agent to process a crafted local path. 2. The file exceeds the documented 10 MB limit, activating the compression procedure. 3. The Agent substitutes the crafted path into the inline Python or unquoted `npx` command. 4. Quote termination or shell metacharacters alter the intended command. 5. Injected Python or shell commands execute under the Agent account. 6. The attacker accesses files, credentials, network resources, or other processes available to that account. For example, a single quote in the Python input path can break out of `Image ...[truncated 615 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate paths into inline Python source. Pass them as positional arguments: ```bash python compression_script.py --input "$INPUT_PATH" --output "$OUTPUT_PATH" ``` 2. Implement compression in a fixed, reviewed script that reads paths from `sys.argv` or another structured input channel. 3. Invoke processes through an argument-array API without a shell, such as `subprocess.run([...], shell=False)`. 4. If a shell command is unavoidable, quote every path using a platform-appropriate quoting library rather than manual escaping. 5. Validate that input paths resolve to expected regular files and that output paths remain within a dedicated working directory. 6. Generate output filenames internally instead of deriving executable command text from user-controlled names. 7. Use a private temporary directory with restrictive permissions and unpredictable filenames. 8. Add tests covering spaces, quotes, command substitutions, semicolons, newlines, leading hyphens, and Unicode characters in paths. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67
• Finding: API Token Exposure Through Chat and Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-73` **Vulnerability Type**: Insecure handling of authentication secrets **Risk Level**: Medium ### Complete Code Snippet ```text When no key is configured, ask the user to provide the key and then execute: qhkit config set --token <key> --env prod Alternatively, set the QHKIT_TOKEN environment variable. ``` ### Technical Analysis The Skill directs the user to send an API key to the Agent and then directs the Agent to place that key in a command-line argument. Secrets passed this way can be exposed through several channels: - Agent conversation transcripts and telemetry; - shell history; - process listings available to other local users or monitoring agents; - command tracing and diagnostic logs; - wrapper scripts or orchestration logs that record executed commands. Using `QHKIT_TOKEN` as an environment variable avoids shell-history exposure but may still reveal the token through child-process environments, crash reports, debugging tools, or environment logging. The instructions do not define redaction, secure storage, process isolation, or restrictive permissions for persisted credentials. ### Attack Path 1. The user sends the API key through the conversation as instructed. 2. The Agent constructs `qhkit config set --token <key> --env prod`. 3. The token is recorded in a transcript, command log, shell history, process monitor, or telemetry system. 4. A local user, administrator, log reader, compromised extension, or monitoring integration retrieves the token. 5. The exposed token is used to invoke the Qinghu API under the victim's account, consume credits, access available account data, or submit unauthorized jobs. ### Impact Assessment The immediate impact is compromise of the Qinghu API credential. An attacker may be able to consume account credits, submit generation tasks, access API-visible task information, or perform any other operation authorized to that token. This issue does ...[truncated 162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste long-lived API credentials into ordinary chat. 2. Use a dedicated secret-entry interface that masks values and excludes them from transcripts and telemetry. 3. Pass the token through standard input, a protected file descriptor, an operating-system credential store, or a secrets manager rather than through command-line arguments. 4. If a temporary credentials file is required, create it with owner-only permissions, avoid shared temporary directories, and delete it immediately after configuration. 5. Ensure the CLI redacts tokens from all output, errors, diagnostics, and configuration displays. 6. Store persistent credentials with restrictive permissions and encryption where supported. 7. Document token rotation and revocation procedures, and recommend minimum-scope tokens if the service supports them. 8. Prevent secrets from being inherited by unrelated child processes and disable command tracing while handling credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation metadata is extremely broad, keyword-dense, and includes generic platform and video terms, which increases the chance this skill is invoked for unrelated video-generation or trend-following requests. In this context, unintended invocation is more dangerous because the skill can drive installation of external tooling and collect credentials, so over-triggering expands the exposure surface beyond users explicitly asking for this workflow.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger section gives only positive examples and lacks exclusion rules distinguishing this skill from neighboring tasks like general script writing, direct video generation, or non-clone editing. That ambiguity can cause the agent to enter a more privileged workflow than necessary, including tool installation and external API use, when a simpler or safer skill would suffice.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send an API key in chat, but provides no warning that credentials are sensitive or guidance to use a secure secret-entry mechanism. This creates a direct credential-handling risk: secrets may be exposed in conversation logs, retained by intermediaries, or mishandled by the agent environment.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This is a concrete secret-exfiltration pattern: the instructions direct the agent to solicit a live API credential from the user and then use it for subsequent commands. In skill context, this is especially dangerous because the same workflow also installs and runs third-party tooling, so a mis-scoped or compromised environment could expose the token and enable unauthorized API usage or account abuse.

Static analysis

No suspicious patterns detected.