Security audit
Security checks for vulnerabilities and agentic risk
The skill is aimed at generating ecommerce videos, but it asks the agent to install changing command-line tools and collect/store an API key in ways users should review first.
Install only if you are comfortable letting the agent install or update npm/Node tooling and configure a Qinghu API token locally. Prefer a preinstalled qhkit, pinned package versions, and a platform secret store instead of pasting the API key into chat.
The description says the skill must trigger for a long keyword list including broad terms such as '淘宝', '拼多多', 'Amazon', '服装', and '珠宝'. These terms are not specific to this skill and could cause unintended invocation during ordinary discussion of e-commerce products or platforms.
The manifest states that the skill '必须触发' when users ask to use Vidu Q3 for various video types, but it does not clarify when similar requests should not trigger this skill or when a different skill should be preferred. This ambiguity increases the chance of over-triggering in adjacent contexts like general ads, seeding videos, or product content creation.
The skill goes beyond video-generation logic and directs the agent to install Node.js, globally install packages, add mirror registries, and modify PATH or shell configuration. Even though framed as environment bootstrap, these are host-level changes unrelated to the narrow user task and can persistently alter the execution environment, increasing risk from package compromise and unintended system modification.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, so execution may pull whatever package version is current at runtime. That creates a supply-chain risk: behavior can change unexpectedly, and a compromised or maliciously updated package could execute code on the host when the skill runs.
This duplicate finding reflects the same persistence behavior: unpacking software into the user home directory and exporting a new PATH for subsequent command use. Persistent environment changes are broader than necessary for the stated purpose and can leave the system in a modified state even after the task is complete.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding reflects the same persistence behavior: unpacking software into the user home directory and exporting a new PATH for subsequent command use. Persistent environment changes are broader than necessary for the stated purpose and can leave the system in a modified state even after the task is complete.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill explicitly instructs the agent to ask the user for an API key and then set it in local CLI config or environment variables. This expands the skill from media generation into credential collection and storage, creating a serious risk of secret exposure, misuse, or persistence outside the user’s intended trust boundary.
The file instructs the agent to send a specific Chinese onboarding message to users and generally frames responses in Chinese, but it does not offer opt-in or language selection. That can violate organizational language/locale policy when users have not requested Chinese output.
The fallback image-compression path uses npx --yes sharp-cli without a pinned version, which fetches and executes the latest package from the registry. Because this is an auxiliary tool invoked on demand, it expands the attack surface and introduces avoidable supply-chain risk from unreviewed package updates or compromise.