阿里Wanx 3.0 爆款视频复刻 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.1

Overview

The skill's video-generation purpose is coherent, but it asks users to paste an API key into chat and directs agents to install mutable third-party packages at runtime.

Review this skill before installing. Use it only in an isolated environment if you accept runtime package installation, avoid pasting API keys into chat, configure tokens through a local secret mechanism instead, and prefer pinned or preinstalled dependencies where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52
• Finding: Unpinned Third-Party Packages Are Installed and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-55`, `SKILL.md:78-81`, and `SKILL.md:91` **Vulnerability Type**: Unsafe runtime dependency installation **Risk Level**: High ### Vulnerable Code Snippets From `SKILL.md:52-55`: ```bash npm i -g @iqinghu/qhkit ``` The same section permits execution through npx: ```bash npx @iqinghu/qhkit <command> ... ``` From `SKILL.md:78-81`: ```bash npm i -g @iqinghu/qhkit@latest ``` From `SKILL.md:91`: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i original-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to download, install, and execute mutable third-party packages at runtime. Exact package versions and integrity hashes are not pinned. The explicit use of `@latest` makes the effective code dependent on whichever release the registry serves at execution time. Global npm installation increases the affected scope because package files and executable entry points are placed in shared user-level or system-level locations. npm packages may also execute lifecycle scripts during installation. The npx commands download and execute packages on demand, while the pip command uses a third-party package mirror without package hash verification. No evidence establishes that the named packages or registries are currently malicious. The vulnerability is the unverified, mutable supply-chain execution path: the reviewed Skill does not fully determine which code will run later. The Node.js checksum command at `SKILL.md:61` is not a `curl | bash` operation. It pipes a checksum manifest through `grep` and `sha256sum`, and extraction is conditioned on successful verification. That particular command is therefore not classified as remote shell payload execution. ### Attack Path 1. An attacker compromises a package maintainer account, package release, dependency, or configured registry. 2. The attacker publishes a malicious ...[truncated 1472 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version instead of using unqualified package names or `@latest`. 2. Commit and enforce lockfiles where possible. 3. Validate package integrity using trusted hashes or signed provenance before installation. 4. Remove automatic global installation. Install dependencies in an isolated, least-privileged project directory, container, or disposable virtual environment. 5. Disable npm lifecycle scripts where they are unnecessary, for example with `--ignore-scripts`, after confirming that the package functions correctly without them. 6. Replace transient npx execution with a pre-reviewed, pinned dependency installed in the isolated environment. 7. Pin Pillow and other Python dependencies by exact version and hash using a requirements file with hash checking. 8. Restrict installation to a single trusted registry. Do not silently switch registries without explicit user approval and equivalent integrity verification. 9. Replace automatic upgrade-on-error behavior with a controlled update process that reviews and verifies the new release before execution. 10. Run media processing with restricted filesystem access, a minimal environment, and no unnecessary credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67
• Finding: API Credentials Are Requested Through Plaintext Conversation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-72` **Vulnerability Type**: Plaintext sensitive credential handling **Risk Level**: Medium ### Vulnerable Instruction and Command The source instructs the user to create or copy an API key and send that key to the Agent. It then directs the Agent to configure the credential using the following command, normalized with an English placeholder: ```bash qhkit config set --token <API_KEY> --env prod ``` It also identifies this alternative: ```bash QHKIT_TOKEN=<API_KEY> ``` ### Technical Analysis Requesting that a user paste an API key into a conversational channel exposes the secret to the entire message-processing path. Depending on the hosting environment, that path may include conversation history, application logs, telemetry, debugging systems, model context, support tooling, or other components not intended to serve as secret stores. Passing the token as a command-line argument introduces an additional local exposure risk. Command arguments may be recorded in shell history and can sometimes be observed through process inspection while the command is running. The API key is necessary for the declared service functionality, but disclosure of the key to the Agent through plaintext chat is not necessary. The user can configure it directly through a secret manager, protected environment injection, or an interactive hidden prompt. No evidence shows that the Skill deliberately transmits the key to an unrelated destination. The issue is unnecessary plaintext handling and persistence of a sensitive credential. ### Attack Path 1. The Skill determines that no API token is configured. 2. It instructs the user to create an API key and send it through the conversation. 3. The user pastes the key into chat. 4. The key becomes part of the conversation context and may be retained in logs, history, telemetry, or debugging records. 5. Alternatively, the Agent places the key directly in a command-line ar ...[truncated 978 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction asking the user to send the API key through chat. 2. Ask the user to configure the key directly in their local environment or approved secret manager. 3. Provide an interactive configuration command that reads the token from a hidden terminal prompt rather than a command-line argument. 4. If environment variables are used, inject them through the platform's protected secret mechanism instead of writing them into chat, scripts, or shell history. 5. Ensure configuration and diagnostic commands always redact tokens. 6. Avoid logging command arguments, environment contents, request headers, or configuration files containing the key. 7. Store credentials with restrictive filesystem permissions and platform-appropriate secure storage. 8. Use narrowly scoped, revocable, and expiring API keys when the service supports them. 9. Advise users who have already pasted a key into chat to revoke and rotate it. 10. Keep credentials out of subprocess environments that do not require access to the service. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill contains extensive instructions to install and configure Node.js, npm packages, and auxiliary tooling that go beyond the core business logic of video cloning. This expands the agent's operational scope into software provisioning and package execution, increasing supply-chain and environment-modification risk if followed automatically.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly tells the agent to ask the user to send an API key in chat and then use it in a command. Collecting secrets through natural-language chat creates a direct path for credential exposure in logs, transcripts, model context, and downstream tooling.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill creates an explicit workflow for soliciting an API key directly in conversation, which is a strong secret-handling flaw. Because agent chats may be stored, reviewed, or reused, this materially increases the chance of credential leakage and subsequent unauthorized API use.

Static analysis

No suspicious patterns detected.