Security audit
Security checks for vulnerabilities and agentic risk
The skill’s video-generation purpose is coherent, but it asks agents to install and run unpinned external packages and collect a user API key, so users should review it before installing.
Install only if you are comfortable letting the agent set up Node/qhkit, run npm/npx packages from the registry, and configure a qhkit API token. Prefer a preinstalled, pinned qhkit version and use a scoped or revocable API key rather than pasting a long-lived secret into chat.
The manifest description is entirely written in Chinese and repeatedly instructs use in Chinese-specific terms, but it does not state that the skill supports other languages or that the locale restriction is intentional and optional. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
This skill goes beyond video generation and instructs the agent to install Node, install npm packages globally, modify PATH, and alter the local runtime. Those actions materially expand the skill's authority and attack surface: a content-generation skill should not need to bootstrap arbitrary software on the host, especially via network downloads and package managers.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which allows whatever version is current at execution time to be fetched and run. In an agent context this creates a supply-chain risk: a compromised latest release or dependency could execute arbitrary code on the host under the guise of fulfilling the skill.
This duplicate finding points to the same persistent-environment behavior: unpacking software into a user directory and exporting a new binary path for future use. In the context of an agent skill, persistence is risky because it can survive the immediate task and influence later sessions or tools in ways the user did not clearly authorize.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistent-environment behavior: unpacking software into a user directory and exporting a new binary path for future use. In the context of an agent skill, persistence is risky because it can survive the immediate task and influence later sessions or tools in ways the user did not clearly authorize.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill explicitly asks the user to send an API key and instructs the agent to set and use that credential. This makes the agent a credential-collection and credential-handling component, increasing the risk of secret exposure in chat logs, tool traces, shell history, or downstream misuse unrelated to the original video-cloning purpose.
The skill falls back to npx --yes sharp-cli for image processing without an exact version pin. That causes on-demand retrieval and execution of the latest package from the registry, exposing the environment to supply-chain compromise or unexpected behavior changes during a seemingly routine media-compression step.