Security audit
Security checks for vulnerabilities and agentic risk
The skill has a legitimate product-image background purpose, but it gives agents broad setup authority to install and update tooling, modify the user environment, and configure a service token.
Review before installing. This skill is not clearly malicious, but it can cause an agent to install or update software, download a Node runtime, change local PATH usage, upload images to a third-party service, and configure a QHKIT token. Prefer using it only in a sandboxed or managed environment where qhkit is already installed and pinned, and approve any credential or installation steps explicitly.
The manifest description says the skill 'must trigger' whenever a user asks to remove backgrounds, make pure-color backgrounds, or batch-process image backgrounds. Several of these phrases are broad and could overlap with ordinary image-editing requests, and the file does not provide negative examples or clear boundaries for when this specific skill should not activate.
The skill is nominally for image background processing, but the documentation expands into environment probing, package installation, Node runtime installation, PATH modification, and credential configuration. This materially broadens the agent's authority from media processing into host setup and system administration, increasing the blast radius if the skill is triggered unexpectedly or manipulated.
The documentation authorizes installation of npm packages and even direct binary downloads of Node, capabilities that are not strictly necessary to describe the image-editing task itself. In an agent-executed setting, these steps enable arbitrary software acquisition and execution, creating a clear supply-chain and host-modification risk beyond the stated purpose.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to be fetched and run. In a skill context, this creates supply-chain risk and undermines reproducibility, especially because the same document also encourages self-bootstrap and installation on demand.
This duplicate finding points to the same persistent installation behavior: extracting software into the user's home directory and changing execution paths. In the context of an image-processing skill, such host persistence is unnecessary and increases long-term risk if the skill is over-triggered or the downloaded toolchain is compromised.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistent installation behavior: extracting software into the user's home directory and changing execution paths. In the context of an image-processing skill, such host persistence is unnecessary and increases long-term risk if the skill is over-triggered or the downloaded toolchain is compromised.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions direct the agent to use the domestic CN site and note that CLI messages are already user-facing Chinese, while telling the agent not to use international-site guidance unless the user explicitly says they use AutoAGC. This creates a locale/language constraint that is not presented as a user choice or opt-in.