YouTube 爆款视频生成 | LinkPix

• Outcome: Review
• Latest audit: Oct 16, 2026 · 3:59 AM UTC
• Version: 0.1.5

Overview

The skill matches its YouTube video-generation purpose, but it also tells the agent to install or upgrade tooling and store an API key locally, so it needs review before use.

Install only if you are comfortable letting the agent install or upgrade Node/npm tooling, use an unpinned qhkit package, upload selected media to the qhkit service, and store a qhkit API key locally. Prefer a preinstalled, pinned qhkit version and provide credentials through a secure secret mechanism rather than pasting long-lived keys into the chat or shell command history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says the skill 'must trigger' whenever a user asks for YouTube viral video generation or YouTube promotional/seeding/ad short videos, and also lists many broad keywords. Phrases like '带货视频', '种草视频', and '投放视频' are generic marketing requests that can overlap with ordinary conversation, and the file does not provide negative examples or clear constraints for when not to invoke this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file states '默认语言 英语', which imposes a language choice by default. This is a natural-language policy issue because it forces a specific locale/language behavior without indicating that the user can choose or opt in first.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger bullets include broad requests such as '做YouTube爆款视频 / 带货视频 / 种草视频 / 投放视频' and '明确要发 YouTube' without defining boundaries or exclusions. Because the skill ecosystem appears to include related model-specific and replication skills, this ambiguity could cause unintended invocation collisions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill goes well beyond video generation by instructing the agent to install Node, globally install or upgrade packages, modify PATH, and manage runtime dependencies. That materially broadens the skill's operational scope into software management, increasing the attack surface and enabling persistent environment changes unrelated to the user's requested media task.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs the agent to execute npx @iqinghu/qhkit without pinning a specific version, which allows whatever the latest package version is at execution time to run. That creates a supply-chain risk: a malicious or compromised upstream release could change behavior, execute unexpected code, or exfiltrate data when the agent follows the documentation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicated persistence finding is still valid because the same documented flow establishes durable local tooling and environment modifications that survive the immediate operation. In the context of a video-generation skill, this persistence is unnecessary and makes the skill materially more dangerous than its declared purpose suggests.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicated persistence finding is still valid because the same documented flow establishes durable local tooling and environment modifications that survive the immediate operation. In the context of a video-generation skill, this persistence is unnecessary and makes the skill materially more dangerous than its declared purpose suggests.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to collect, set, and potentially persist API credentials using qhkit config set --token <密钥> --env prod or environment variables. This gives the skill secret-handling behavior beyond simple service invocation and creates risk of credential exposure, misuse across sessions, or accidental retention in shell history, config files, or logs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill also directs the agent to run npx --yes sharp-cli without a pinned version for local image compression. This extends the same supply-chain risk to an additional package and is more concerning because it is invoked on local files, expanding exposure to arbitrary code execution from an unverified dependency.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The image-compression step instructs the agent to perform local file transformation and, if needed, install additional Python or Node dependencies. While likely intended as convenience, it broadens the skill into local file processing and ad hoc dependency installation, which increases attack surface and creates opportunities for unsafe handling of user-supplied files.

Content

No source excerpt is available for this finding.