青虎AI-AI电商助手 | 选品上货 | 数据采集 | AI生图 | AI生视频

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:18 AM UTC
• Version: 0.1.14

Overview

The skill is a coherent media-generation integration, but it asks agents to install unpinned tools globally, collect an API key in chat, and upload local media in some estimate flows without a separate consent step.

Install only if you are comfortable letting the agent install and update qhkit/npm tooling, send selected local media to Qinghu, and handle a Qinghu API key. Use a restricted environment, avoid pasting secrets into normal chat where possible, review every upload and paid generation request, and do not use the face-replacement or watermark-removal features unless you have clear rights and consent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52
• Finding: Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52-54, 75, and 96-99 **Vulnerability Type**: Uncontrolled third-party dependency installation and execution **Risk Level**: High ### Relevant Code ```bash npm i -g @iqinghu/qhkit ``` ```text If global installation fails because of permissions and privilege elevation is unavailable, use: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i original-image -o compressed.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to install and execute npm and Python packages without pinning exact versions or cryptographic integrity values. The explicit use of `@latest` and `npx --yes` allows newly published package versions to execute without review. npm package lifecycle scripts may execute during installation, while `npx` immediately downloads and runs package code. Global npm installation also modifies the user-wide executable environment rather than using a task-scoped, isolated dependency directory. The npm and Python mirror fallbacks introduce additional supply-chain trust boundaries. This behavior is related to the declared media-generation functionality because the Skill depends on `qhkit`, but it exceeds minimum privilege and change scope by globally installing packages and automatically executing unreviewed versions. Image compression helpers should likewise be installed in an isolated, version-pinned environment rather than fetched dynamically. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, a maintainer account, or a configured package registry or mirror. 2. The attacker publishes a malicious version or adds a malicious installation lifecycle script. 3. The Agent follows the Skill's environment-bootstrap instructions and runs an unversioned installation, `@latest`, or `npx --ye ...[truncated 971 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version. Do not use `@latest` or unversioned package specifications. 2. Record and verify package integrity hashes through a lockfile or an equivalent trusted manifest. 3. Replace global npm installation with a task-scoped installation in an isolated directory or container. 4. Disable npm lifecycle scripts where they are unnecessary, for example with `--ignore-scripts`, after confirming the package still functions correctly. 5. Replace `npx --yes` with a locally installed, exact-version executable. 6. Pin Pillow and `sharp-cli` to reviewed versions and install them only in isolated virtual environments or task-specific Node projects. 7. Prefer the official package registries. If mirrors are required, document their trust model and verify downloaded artifacts against integrity values obtained from an independent trusted source. 8. Require explicit user approval before changing the local software environment. 9. Publish and audit the source and dependency tree of `@iqinghu/qhkit`, which is not included in this project and therefore could not be reviewed in this audit. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64
• Finding: API Token Is Passed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Plaintext secret exposure through process arguments, logs, and shell history **Risk Level**: Medium ### Relevant Code ```bash qhkit config set --token <API_KEY> --env prod ``` The same instruction also permits configuration through: ```bash QHKIT_TOKEN ``` ### Technical Analysis The Skill tells the Agent to obtain an API key from the user and interpolate it directly into a command-line argument. Command-line secrets may be exposed through shell history, process inspection facilities, terminal capture, command auditing, Agent transcripts, or diagnostic logs. Although the environment-variable alternative is preferable to a literal command argument, environment variables can also leak through child processes, crash reports, debugging output, or unsafe process-environment inspection. The document does not define redaction, protected storage, restrictive configuration-file permissions, or secret lifecycle requirements. The token is necessary for the declared service functionality, but exposing it in command syntax is not the minimum-risk authentication mechanism. ### Attack Path 1. The user sends an API token to the Agent as directed by the Skill. 2. The Agent constructs and executes `qhkit config set --token <API_KEY> --env prod`. 3. The plaintext token is retained in shell history, process telemetry, a terminal log, an Agent transcript, or another command-auditing system. 4. A local user, administrator of a logging platform, compromised process, or unauthorized transcript reader retrieves the token. 5. The attacker authenticates to the Qinghu service using the stolen credential. 6. The attacker accesses functions permitted by that token or consumes the victim's service credits. ### Impact Assessment The exposure affects the Qinghu account and permissions associated with the token. Depending on server-side token scope, an attacker may submit paid generation ...[truncated 322 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place secrets in command-line arguments. 2. Use a non-echoing interactive prompt, standard-input secret channel, operating-system credential store, or host-managed secret injection mechanism. 3. Ensure the Agent never repeats the token in responses, command previews, error messages, or transcripts. 4. If an environment variable must be used, inject it only into the target process, avoid exporting it globally, and clear it immediately after use. 5. Store persistent credentials only in a file with restrictive permissions, such as mode `0600`, or in a platform credential manager. 6. Use narrowly scoped, short-lived tokens where the service supports them. 7. Document token revocation and rotation procedures. 8. Redact known token formats from shell logs, process telemetry, and Agent traces. 9. Require the user to enter the token through a secure secret-input interface rather than sending it as ordinary conversation text. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:117
• Finding: Read-Only Estimate Operation Uploads Local Media Without Separate Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 117 and 349-350 **Vulnerability Type**: Unexpected external transmission of local files **Risk Level**: Medium ### Relevant Code ```text Read-only actions (`options` / `estimate` / `status` / `templates` / `products` / `config show`) do not require confirmation and may be called directly. ``` The documented exception states: ```text `workflow estimate` is an exception: local assets are actually uploaded because workflow pricing requires real asset URLs. ``` It is reiterated later: ```text `workflow estimate` will actually upload local assets. Other estimate commands do not upload files. ``` ### Technical Analysis The Skill generally classifies `estimate` as a read-only action that does not require confirmation. However, `workflow estimate` uploads local images, video, or audio to an external service to obtain a price estimate. Uploading a file is a material external side effect and is not read-only from a confidentiality or privacy perspective. A user asking only for pricing may reasonably expect that local assets will remain on the machine until generation is explicitly approved. The Skill discloses this exception in its documentation, but it does not require explicit, informed user consent before the upload. The mandatory confirmation applies before paid generation, not before this estimate-side transmission. This can exceed the minimum privileges and data access required for a preliminary pricing request. ### Attack Path 1. A user requests a workflow price estimate and references a local image, video, or audio file. 2. The Agent follows the rule that estimate operations can run without user confirmation. 3. `qhkit workflow estimate` reads the local file and uploads it to the Qinghu service. 4. The external service receives or stores the media before the user approves generation or explicitly consents to transmission. 5. If the media contains confidential, personal, copyrighted ...[truncated 846 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before any estimate operation uploads a local file. 2. Clearly list every file that will be uploaded, the destination service, the purpose of the upload, and whether the service retains the data. 3. Separate local validation from remote estimation so that no data transmission occurs during nominally read-only operations. 4. Provide a metadata-only pricing mode based on file type, size, duration, resolution, and workflow parameters whenever exact content is unnecessary. 5. If the remote API requires a real URL, use a dedicated user-approved sample asset rather than the user's production media. 6. Do not describe `workflow estimate` as read-only. Classify it as a network side-effecting operation in the interaction policy. 7. Apply data minimization by uploading only the smallest necessary derivative, where technically valid and approved by the user. 8. Document remote retention, deletion, encryption, access-control, and regional-processing policies. 9. Avoid recommending an existing public URL as a workaround unless the user understands that the URL itself exposes the asset to remote retrieval. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to install Node/qhkit, modify PATH, use package mirrors, and change host configuration to satisfy the skill. That expands the skill from media generation into host bootstrap and software deployment, increasing supply-chain and environment-tampering risk if followed on arbitrary systems.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill tells the agent to ask the user to send an API key directly and then persist it via CLI config or environment variables. This creates unnecessary credential-handling by the agent, risks key disclosure in chat logs/history, and broadens compromise impact if the host or transcript is exposed.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The activation guidance is extremely broad and says many ordinary media-related requests 'must' trigger this skill. Over-broad routing can cause unintended invocation of a powerful external tool, leading to unnecessary data upload, credit consumption, or execution of sensitive editing actions the user did not explicitly request.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to ask the user to send their API key in chat, without any security warning or safer alternative. This is dangerous because conversational channels are often logged, inspectable, and not appropriate for raw secret transfer.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises watermark removal and face-replacement features without any safeguards around consent, ownership, authorization, or lawful use. In context, these are dual-use media manipulation capabilities that can facilitate impersonation, copyright circumvention, or deceptive content creation if invoked casually.

Static analysis

No suspicious patterns detected.