阿里Wanx 3.0 电商带货视频 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.1

Overview

The skill is a coherent video-generation connector, but it asks the agent to install mutable third-party tools at runtime and collect an API key through chat.

Review before installing. Use it only if you specifically intend to use Qinghu/qhkit/LinkPix for Wanx video generation. Prefer preinstalling trusted, pinned tool versions yourself, avoid pasting API keys into chat, use a narrowly scoped revocable token, and expect referenced product media to be uploaded to the external service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:51
• Finding: Runtime Installation and Execution of Mutable Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-54`, `SKILL.md:77-80`, and `SKILL.md:90` **Vulnerability Type**: Unsafe runtime dependency installation and supply-chain exposure **Risk Level**: High ### Complete Code Snippets ```bash npm i -g @iqinghu/qhkit ``` The accompanying instructions permit fallback to a mirror and execution through `npx`: ```text Default to the official npm registry; if it is slow or times out, add --registry=https://registry.npmmirror.com. Only when global installation fails because of permissions and privilege elevation is unavailable, fall back to npx @iqinghu/qhkit <command> ... ``` The upgrade procedure installs the most recently published version without pinning it: ```bash npm i -g @iqinghu/qhkit@latest ``` Image-processing dependencies may also be installed or executed dynamically: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to retrieve and execute third-party packages at runtime. The primary CLI is globally installed without an exact version or integrity constraint, while the upgrade procedure explicitly selects `@latest`. The `npx --yes` fallback can download and execute the currently resolved package without interactive review. Package installation can execute package lifecycle hooks and subsequently runs the installed application with the Agent user's permissions. Because the effective package contents are resolved after the Skill has been reviewed, a compromised publisher account, malicious package release, registry compromise, or dependency-chain compromise could change the code that is executed. Use of alternate npm and Python registries expands the supply-chain trust boundary. The required video-generation CLI is legitimate to the declared functionality, but automatically installing mutable packages, globally where possible, exceeds the min ...[truncated 1864 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a specific reviewed version rather than using an unconstrained package name or `@latest`. 2. Verify package integrity using lockfiles, npm integrity metadata, hashes, or signed release artifacts. 3. Remove automatic `npx --yes` execution. Require explicit user approval before downloading or executing a package that is not already installed. 4. Avoid global installation. Install dependencies into a dedicated, non-privileged project directory or isolated container. 5. Prefer a prebuilt, reviewed runtime image containing fixed versions of Node.js, `qhkit`, Pillow, and image-processing tools. 6. Pin and audit transitive dependencies, and monitor package ownership and release changes. 7. Minimize registry switching. If mirrors are required, document their trust model and validate retrieved artifacts against hashes obtained through an independent trusted channel. 8. Run the CLI with restricted filesystem and network access, exposing only the media files and service endpoints required for the requested operation. 9. Require explicit user confirmation before any environment modification, separate from confirmation of paid video generation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: API Token Requested Through the Conversational Channel<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:66-71` **Vulnerability Type**: Insecure secret collection and storage workflow **Risk Level**: Medium ### Complete Code Snippet ```text 4. Key: When no key is available (the command returns stage:"config"), send the following guidance to the user, and after receiving the key run qhkit config set --token <key> --env prod (or set the QHKIT_TOKEN environment variable): 1. Open the Qinghu registration/login page. 2. Open the APIKeys page in the dashboard. 3. Create/copy a key, then send the API key to me. ``` ### Technical Analysis An API token is necessary to authenticate to the declared video-generation service. However, the Skill explicitly instructs the user to send the secret to the Agent through the conversation. This exposes the token to the conversational context and potentially to transcript storage, telemetry, debugging logs, model-provider processing, or downstream automation. The recommended `qhkit config set --token <key> --env prod` command also places the token in a command-line argument. Depending on the execution environment, command history, process inspection, or Agent tool logs may retain the plaintext value. The vulnerability is not the legitimate need for service authentication; it is the unnecessary disclosure of the credential through channels that are not designed as secret-entry mechanisms. ### Attack Path 1. The Agent reports that `qhkit` is not configured and follows the Skill's prescribed guidance. 2. The user pastes the production API key into the chat. 3. The token becomes part of the conversation transcript and may also be copied into a logged shell command. 4. A party with access to conversation records, telemetry, command logs, shell history, or process information obtains the token. 5. The party authenticates to the Qinghu API as the user. 6. The exposed token may be used to submit unauthorized generation jobs, consume paid credits, or access any service data ...[truncated 582 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never ask users to paste API keys into the conversation. 2. Direct users to configure the token themselves through a secure local prompt, operating-system credential store, or approved secret manager. 3. Add a CLI command that reads the token from hidden standard input rather than accepting it as a command-line argument. 4. Prevent secrets from appearing in shell history, process arguments, Agent tool logs, error messages, and telemetry. 5. Store credentials using restrictive file permissions or a platform-native credential vault; do not keep them in plaintext configuration when avoidable. 6. Use narrowly scoped, revocable tokens with spending limits and the minimum API permissions required for video generation. 7. Redact token-like values from all command output and diagnostic logs. 8. Document revocation and rotation procedures and advise users to rotate any token previously pasted into a conversation. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to bootstrap and modify the host environment by downloading/installing Node, qhkit, Pillow, and sharp-cli, including global package installs and PATH changes. That exceeds the narrow scope of a content-generation skill and creates supply-chain and host-integrity risk, because invoking the skill can lead to arbitrary external code being fetched and executed on the machine.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger description is very broad and keyword-heavy, causing the skill to activate for many generic e-commerce or video-generation requests. Overbroad invocation increases the chance that the agent routes unrelated user tasks into a workflow that performs external CLI calls, uploads local files, or requests credentials when the user did not specifically intend to use this integration.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The '何时触发' section uses ambiguous activation rules without clear boundaries, which can lead the agent to invoke the skill whenever a request loosely resembles product-video generation. In context, that is risky because the skill can lead to external network operations, file handling, and credential solicitation, so mistaken activation has tangible security and privacy consequences.

Static analysis

No suspicious patterns detected.