电商白底图生成 | 批量抠图 | 去背景 | 透明底图 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.5

Overview

The skill has a plausible product-image purpose, but it should be reviewed because it installs mutable command-line software and tells the agent to follow upgrade commands emitted by that tool.

Install only if you are comfortable with qhkit being installed or run on the machine, selected images being uploaded to the service, and a QHKIT token being used. Prefer a pinned, reviewed qhkit version, avoid executing upgrade commands copied from tool output, and confirm ambiguous cutout or background-removal requests before sending images to the service.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42
• Finding: Unpinned Global Installation and Execution of Third-Party npm Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-45` and `SKILL.md:63-66` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and download-on-demand execution **Risk Level**: Medium ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit download-on-demand execution: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly installs the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` Both installation paths may use an alternative registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning an audited version or package integrity value. The `@latest` upgrade path intentionally resolves to mutable package content, while the `npx` fallback can download and execute package code immediately. npm packages can run executable CLI code and may also run lifecycle scripts during installation. Consequently, the effective code executed by this Skill is not fully represented by the audited `SKILL.md` file and can change after the audit. Using a global installation also broadens the modification scope beyond a task-specific directory. Depending on npm configuration, it can modify user-level or system-level executable locations. The instructions do not request privilege elevation and explicitly acknowledge permission failures, so no privilege escalation is demonstrated; execution remains limited to the privileges of the Agent process. The alternative registry is described as a fallback, but it expands the number of supply-chain systems that must remain trustworthy. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, the publication process, or a permitted registry. 2. The attacker publishes a malicious release under the legitimate package name. 3. The Agent runs `npm i -g @iqinghu/qhkit`, `npm i -g @iqinghu/qhkit@latest`, or t ...[truncated 1207 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using an unqualified package name or `@latest`. 2. Record and verify the expected package integrity digest before execution. 3. Use a lockfile and a project-local installation in an isolated working directory instead of a global installation. 4. Avoid `npx` download-on-demand execution. If `npx` is unavoidable, specify an exact version and prevent automatic substitution with another release. 5. Remove instructions that automatically install the latest release. Upgrade only to an explicitly reviewed version. 6. Prefer the primary npm registry and require explicit user approval before switching registries. 7. Where compatible with the package, disable installation lifecycle scripts and enable only those specifically required after review. 8. Execute the CLI in a sandbox with access limited to the intended input images, output directory, required token, and required network endpoints. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:60
• Finding: Unvalidated Execution of Upgrade Commands Supplied Through Tool Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:60` **Vulnerability Type**: Trusting mutable CLI output as an executable command source **Risk Level**: High ### Complete Code Snippet The operative instruction at line 60 states, in English: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; follow it directly. ``` The document then provides the expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to treat the `message` field returned by `qhkit` as an authoritative source of shell commands and to execute the supplied command directly. It does not define an allowlist, validate the executable and arguments, or require user confirmation. Tool output is mutable and may originate from the installed CLI, a remote API response interpreted by that CLI, or a replaced executable found earlier in `PATH`. Treating this data as an executable instruction creates a command-execution boundary controlled by the tool rather than by the audited Skill. This pattern is especially dangerous because the Skill separately allows mutable npm installation and upgrades. A compromised package or spoofed executable could emit a malicious version response that appears structurally valid while embedding an unrelated shell command. ### Attack Path 1. An attacker compromises or replaces the `qhkit` executable, compromises its dependency chain, or gains control over a response used to construct its version-error message. 2. The malicious tool returns a response containing `stage:"version"` and places an attacker-selected command in the `message` field. 3. The Agent follows the Skill instruction to execute the command directly. 4. The supplied command runs in the Agent's shell without an allowlist or argument validation. 5. The attacker gains arbitrary command execution with the Agent user's privileges and may access files, tokens, or network resou ...[truncated 1055 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute upgrade commands found in a tool-generated message. 2. Define the upgrade operation locally as a fixed command rather than accepting executable text from stdout or stderr. 3. Pin the target upgrade version and integrity digest; do not use `@latest`. 4. Parse version responses strictly as data. Permit only known stage values and non-executable version identifiers. 5. If automated upgrades are necessary, construct arguments from an allowlisted semantic-version format and invoke npm without a shell. 6. Require explicit user approval before installing or upgrading software. 7. Resolve and verify the expected `qhkit` executable path before invocation to reduce `PATH` spoofing risk. 8. Reject messages containing shell metacharacters, URLs, command substitutions, redirections, pipelines, or additional executables; do not rely on filtering as a substitute for fixed commands. 9. Run upgrade and execution operations in a restricted environment with minimal filesystem, credential, and network access. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The skill uses mandatory, broad trigger language ('必须触发') covering generic image-editing requests like background removal, whitening, and cutout, without clear exclusion boundaries. In an agentic environment, this can cause incorrect or overly aggressive invocation, leading the system to send user images to an external CLI/service when the user may have intended a different workflow or a safer/local alternative.

Static analysis

No suspicious patterns detected.