AI爆款视频复刻、音频提取 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:17 AM UTC
• Version: 0.1.5

Overview

The skill is coherent for video analysis and generation, but it asks agents to install and upgrade unpinned executable tools, mutate the user environment, and handle an API token in ways that need careful review.

Install only if you are comfortable with qhkit being added to the environment and with LinkPix/qhkit receiving the video links and media you provide. Prefer a pinned, reviewed, local installation; avoid `@latest` upgrades and unpinned `npx`; do not paste tokens into commands visible in logs or history; use a protected secret mechanism or environment variable instead. Review any shell-profile, PATH, or global npm changes before allowing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:41
• Finding: Unpinned Executable npm Dependency and Unsafe Automatic Upgrades<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6, 41-46, 66-70` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🔥","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to download and execute `@iqinghu/qhkit` without pinning an audited version or package integrity value. It also instructs the Agent to install the latest available version when an upgrade condition occurs. Consequently, the effective code executed by the Skill can change after this document has been reviewed. npm lifecycle scripts may also run during installation. A compromise of the package publisher, npm account, package release process, registry, or configured fallback mirror could introduce arbitrary executable code. Using a global installation unnecessarily increases the installation scope. The documented `npx` fallback still retrieves and executes an unpinned package and therefore does not eliminate the supply-chain risk. The Skill also accepts upgrade instructions returned by the external CLI service. Although the documented command is limited to upgrading `qhkit`, automatically following remotely influenced upgrade guidance expands the trust boundary beyond the audited Skill text. ### Attack Path 1. An attacker compromises the package publisher account, release pipeline, npm package, registry response, or fallback mirror. 2. The attacker publishes a malicious version of `@iqinghu/qhkit`, potentially including an npm lifecycle script or malicious CLI implementation. 3. The Agent follows the Skill instructions and runs the unpinned global installation, `npx` command, or `@latest` upgrade. 4. npm downloads and installs the attacker-contr ...[truncated 1012 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version in both metadata and installation commands. 2. Commit a lockfile containing npm integrity hashes, or independently verify the downloaded package against a trusted digest before execution. 3. Replace `@latest` upgrades with a controlled process that reviews and pins each new release before deployment. 4. Prefer a project-local installation in an isolated directory rather than a global installation. 5. Avoid `npx` execution of an unpinned package. Invoke only the locally installed, version-pinned binary. 6. Disable npm lifecycle scripts with `--ignore-scripts` where the package can function without them. If lifecycle scripts are required, audit them before installation. 7. Require explicit user approval before installing or upgrading executable dependencies. 8. Do not recommend privilege elevation for installation. Use a non-privileged user directory or isolated container. 9. Treat registry mirrors as separate supply-chain trust boundaries and verify identical package integrity before using them. 10. Run the CLI with restricted filesystem access, a minimal environment, and only the network access required for its declared service. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59
• Finding: API Token Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <API_TOKEN> --env prod ``` ### Technical Analysis The documented configuration flow places the API token directly in a command-line argument. Command arguments may be captured in interactive shell history, terminal recordings, Agent transcripts, audit logs, crash diagnostics, process-monitoring systems, and process listings. On operating systems where other local users or monitoring services can inspect process arguments, the token may be visible while the command is running. Even after execution, shell history or automation logs can preserve the credential indefinitely. This exposure is avoidable because the same section states that `QHKIT_TOKEN` can be used. A protected secret-injection mechanism or a non-echoing prompt would better preserve confidentiality. ### Attack Path 1. A user obtains a valid LinkPix API token and substitutes it into the documented command. 2. The Agent or user executes the command in a shell. 3. The complete command is recorded in shell history, an Agent transcript, terminal logs, process telemetry, or automation logs; alternatively, a local observer reads the process arguments while it is running. 4. An unauthorized local user, administrator of a logging system, or party with transcript access retrieves the token. 5. The attacker uses the token to authenticate to the associated service and perform operations permitted by that credential. ### Impact Assessment The direct impact is disclosure of the LinkPix API token. An attacker may consume account credits, submit unauthorized generation or analysis jobs, access information exposed by the API to that token, or disrupt the associated account. The operating-system privileges gained are limited to those already available to the observer w ...[truncated 130 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to place the token directly in a command argument. 2. Add a non-echoing interactive configuration command that reads the token from the terminal or standard input. 3. Prefer secret injection through a protected environment mechanism rather than a literal command entered into shell history. 4. If a secret file is supported, require restrictive permissions such as mode `0600` and avoid shared temporary directories. 5. Ensure the CLI redacts tokens from standard output, standard error, diagnostics, and configuration display. 6. Instruct Agents never to reproduce tokens in transcripts or user-facing responses. 7. Disable shell history temporarily only as a secondary safeguard; do not rely on it as the primary secret-handling mechanism. 8. Document token rotation and immediate revocation procedures for credentials that may have been exposed. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to install Node/qhkit, change PATH, download binaries, and modify the runtime environment as part of normal execution. That expands the skill from content analysis into software installation and environment mutation, increasing supply-chain and host-integrity risk if triggered automatically or on shared systems.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill solicits and configures a user API token for a third-party service, including passing it on the command line and storing it in tool configuration or environment variables. Handling credentials is sensitive because tokens may be exposed in shell history, process listings, logs, or reused beyond the user's intent.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger text is broad and mandatory, causing the skill to activate for a wide range of common TikTok/Douyin link-analysis or audio-extraction requests. Over-broad invocation can route unrelated user requests into a high-risk skill that installs software, handles tokens, and contacts third-party services without sufficiently specific consent.

Static analysis

No suspicious patterns detected.