Security audit

青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill fits its stated purpose, but needs review because it permits automatic software changes and sends some requests or media before user approval.

Before installing, require approval for software installation, upgrades, elevation, and shell-profile edits. Prefer a reviewed package version in an isolated environment. Minimize discovery queries and approve media uploads before requesting estimates, since estimates can upload files before paid generation is confirmed. Configure the API key locally rather than sharing it in chat. Package code and publisher ownership could not be independently verified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Automatic environment setup changes the system without requiring advance user disclosure.

Medium

Category: Output Handling
Confidence: 95% confidence
Finding: The skill directs the agent to install software globally and bootstrap a runtime without first obtaining authorization for those environment changes. The explicit confirmation requirement covers paid task submission rather than installation, so requesting media generation could cause unexpected persistent changes and execution of downloaded code; the Node checksum requirement helps integrity but does not address authorization.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @iqinghu/qhkit'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The fallback executes an unpinned npm package, allowing the code run by the agent to change without review. Although qhkit is a CLI rather than an MCP server, a compromised or malicious release could execute with the agent's filesystem and credential access; the surrounding automatic installation and latest-version upgrade instructions increase exposure.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes sharp-cli'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The image-compression fallback downloads and executes an unpinned sharp-cli package, while --yes suppresses npm's installation prompt. This is not an MCP server, but it is a genuine supply-chain exposure: compromised package code or dependencies could access local media, credentials, and other files under the agent's permissions.
Content: No source excerpt is available for this finding.

Tool discovery sends the user's original request to an external service without a privacy warning.

Medium

Category: Output Handling
Confidence: 94% confidence
Finding: The discovery instructions explicitly permit sending the user's original request to the external search service, and discovery is exempt from confirmation. External queries are expected for this skill, but forwarding the full request can unnecessarily disclose confidential business details or personal information before the user approves any substantive operation; removing generic service names is not privacy redaction.
Content: No source excerpt is available for this finding.

Artifact titles are required to be Chinese without user language opt-in.

Low

Category: Output Handling
Confidence: 96% confidence
Finding: The required artifact format specifies a short Chinese title ('简短中文名'). This explicitly constrains user-visible output to Chinese without offering a language choice or explaining why the integration requires Chinese titles.
Content: No source excerpt is available for this finding.