Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent video-generation purpose, but it should be reviewed because it directs agents to automatically install and run unpinned remote tooling and make persistent local environment changes.
Install only if you are comfortable with the agent installing or upgrading Node/npm/Python helper packages, changing local PATH or qhkit configuration, receiving your Qinghu API key, uploading your media to Qinghu services, and spending account credits after confirmation. Prefer a preinstalled, pinned qhkit version in an isolated environment.
The manifest description says the skill 'must trigger' when users ask to recreate viral videos and also lists a long set of broad keywords such as 抖音, TikTok, Reels, 时尚穿搭, and 饰品开箱. These terms are common topic words rather than narrow invocation phrases, and the file does not provide exclusion conditions or negative examples to distinguish when the skill should not activate.
The '何时触发' section uses phrases like '复刻这条爆款 / 对标 / 照着做' and activation when the user names the model and provides a social-media link, but it does not clarify boundaries for similar requests that should route elsewhere. Without explicit non-trigger cases in this section, adjacent requests about general video creation or trend analysis could invoke the skill unintentionally.
The skill goes beyond its stated video-cloning purpose by directing the agent to install Node, globally install packages, modify PATH, and bootstrap a broader runtime environment. Expanding a skill's operational scope this way increases attack surface and enables execution of network-fetched tooling, making compromise or misconfiguration more likely if the skill is triggered unexpectedly.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning a specific version, which means each invocation may fetch whatever package version is current at execution time. In an automated agent context, this creates a supply-chain risk: a compromised publisher account, malicious package update, or breaking release could cause arbitrary code execution during dependency resolution or runtime.
This duplicated finding describes the same persistence behavior: writing executables under the user's home directory and exporting a modified PATH. Even though the example includes checksum verification, the persistence itself remains risky because it changes future command resolution for the session and potentially subsequent workflows if shell config is updated as suggested.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding describes the same persistence behavior: writing executables under the user's home directory and exporting a modified PATH. Even though the example includes checksum verification, the persistence itself remains risky because it changes future command resolution for the session and potentially subsequent workflows if shell config is updated as suggested.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions hard-code a China-site account flow, Chinese user-facing guidance, and direct the agent to avoid international-site handling unless the user explicitly states they use it. This imposes a locale-specific workflow by default rather than offering the user a language/region choice or clearly framing it as an opt-in region-specific skill.
The instruction to run npx --yes sharp-cli pulls and executes the latest package version on demand, again introducing an unpinned remote code execution path. Because this is framed as an automatic fallback for local image processing, the agent may execute third-party code outside the skill's core trust boundary whenever a large image is encountered.
The manifest frames the skill around replicating hit videos through Qinghu AI, but this line authorizes the agent to run Python or Node-based image processing toolchains and install Pillow or sharp-cli as needed. Local media manipulation is an extra capability not clearly justified by the stated role of a Vidu Q3 replication skill, especially when combined with on-the-fly dependency installation.