Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed LinkPix/qhkit integration for AI ecommerce media and data tasks, with the main user risks being external media uploads, API-key use, paid operations, and npm package trust.
Install only if you trust Qinghu/qhkit and are comfortable giving it an API key, uploading the media you provide, and spending Qinghu credits after confirmation. Use it only on content you are authorized to edit, especially for face replacement, watermark removal, and video translation. For stronger supply-chain control, prefer a pinned reviewed qhkit version instead of unpinned npx or @latest flows.
The trigger definition is extremely broad and uses mandatory activation language for a wide range of ordinary ecommerce, media, and data-analysis requests. In an agent setting, overbroad routing can cause the skill to activate unexpectedly, increasing chances of unnecessary credential prompting, external tool execution, and data transfer to third-party services.
L031-L033 advertise '换脸', '角色替换', and '去水印 / 去字幕' as available operations, but the markdown does not warn users that these actions may implicate consent, copyright, or ownership concerns. Because these behaviors can affect user data rights and system integrity expectations, the omission is a missing warning under the skill description criteria.
The skill instructs use of npx @iqinghu/qhkit <命令> ... without pinning a specific version. That allows whatever version is current at execution time to be fetched and run, creating a supply-chain risk and making behavior non-reproducible if a compromised or breaking release is published.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
校验行输出 `OK` 才继续；校验失败就删掉重下，**绝不解包未通过校验的文件**。nodejs.org 访问不通时，把两个下载 URL 的前缀 `https://nodejs.org/dist` 整体换成镜像 `https://registry.npmmirror.com/-/binary/node`（目录结构相同，SHASUMS256.txt 也有镜像，校验步骤不变）。`export PATH` 只对当前 shell 生效，跨命令调用时每个新 shell 都要先执行这行（或追加进 `~/.bashrc`）。macOS 用 `brew install node`；Windows 用 winget/官网安装包。arm64 机器把 `x64` 换成 `arm64`。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
校验行输出 `OK` 才继续;校验失败就删掉重下,**绝不解包未通过校验的文件**。nodejs.org 访问不通时,把两个下载 URL 的前缀 `https://nodejs.org/dist` 整体换成镜像 `https://registry.npmmirror.com/-/binary/node`(目录结构相同,SHASUMS256.txt 也有镜像,校验步骤不变)。`export PATH` 只对当前 shell 生效,跨命令调用时每个新 shell 都要先执行这行(或追加进 `~/.bashrc`)。macOS 用 `brew install node`;Windows 用 winget/官网安装包。arm64 机器把 `x64` 换成 `arm64`。
L065-L072 instruct the agent to send a fixed Chinese guidance message and to steer users to the domestic iqinghu.com flow unless they explicitly state they use the international account. This imposes a specific language/locale workflow without user opt-in or an offered alternative, which is a natural-language language/locale policy violation.
The fallback image-compression path runs npx --yes sharp-cli, which fetches and executes the latest published package at runtime. This is a classic supply-chain exposure: a malicious or hijacked upstream release would run arbitrary code on the host under the agent's privileges.
No suspicious patterns detected.