Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该描述先列举了几个具体触发短语，但又补充“或提出同类需求时必须触发”，把触发范围扩展到未定义的相似表达，边界不清。对于清单型触发规则，这种兜底表述会增加与普通对话重叠的风险，也没有提供负例或不触发条件。
- Content
Security audit
AI生成图片检测 | 青虎AI
Security checks for vulnerabilities and agentic risk
Overview
The skill performs AI-image detection through Qinghu as claimed, but it also asks the agent to install tooling, modify the user environment, and configure external credentials in ways that need review before installation.
Review this skill before installing. It appears aimed at legitimate Qinghu AI-image detection, but only use it if you are comfortable sending images or image URLs to Qinghu, spending Qinghu credits, installing or upgrading qhkit/Node locally, and storing a Qinghu token for the tool. Prefer a sandboxed or platform-managed qhkit install and avoid letting it modify shell startup files unless you intentionally want that persistent setup.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to send
imageUrlorimageBase64to an external service but does not clearly disclose to the user that their image content will be transmitted to a third party. For image-analysis workflows this matters because the data may be sensitive, copyrighted, or private, and users need informed consent before off-platform transfer.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill's 'environment bootstrap' section goes well beyond image detection and instructs the agent to install Node, install packages globally, modify PATH, and persist runtime changes. That expands the skill's authority from data processing into host modification, creating avoidable attack surface and making a simple image-analysis task capable of changing the execution environment. The broader capability makes misuse or accidental damage more likely.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 81% confidence
- Finding
The skill recommends falling back to
npx @iqinghu/qhkitwithout pinning a specific version. That causes execution of whatever package version is current at invocation time, increasing supply-chain and reproducibility risk if the package is updated maliciously or incompatibly. In this context the risk is amplified because the skill is allowed to install tooling and then use it to process user data and credentials.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
This duplicate finding identifies the same persistence behavior: unpacking software under the user's home directory and exporting PATH in a way the documentation suggests may be carried across sessions. Persistent environment mutation is unnecessary for the stated image-detection purpose and increases long-term system risk beyond the immediate task.
- Content
Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
This duplicate finding identifies the same persistence behavior: unpacking software under the user's home directory and exporting PATH in a way the documentation suggests may be carried across sessions. Persistent environment mutation is unnecessary for the stated image-detection purpose and increases long-term system risk beyond the immediate task.
- Content
Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to obtain and configure API credentials for an external service, including setting tokens via command line or environment variables. Credential setup is a separate privileged workflow from image detection, and embedding it in the skill increases the chance of secrets exposure, unsafe storage, or prompting users to divulge credentials inappropriately.
- Content
Static analysis
No suspicious patterns detected.