ClawHub
Back to skill

Security audit

青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real media-generation integration, but it asks the agent to install and update host tooling and collect/persist an API key with limited user control.

Review this skill before installing. It appears purpose-built for Qinghu media workflows, but only use it in an environment where you are comfortable with agent-managed npm/Node tooling, local media uploads, and persistent qhkit API-key configuration. Prefer a sandboxed environment and platform secret storage rather than sending API keys through chat.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Vague Triggers

High
Confidence
98% confidence
Finding
The trigger list is extremely broad and includes many generic commerce and media terms, making accidental invocation likely. In an agent setting, overbroad routing can cause this skill to activate on loosely related user requests and then proceed into installation, credential solicitation, or costly remote operations that the user did not explicitly intend.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill goes far beyond media generation by instructing the agent to install Node, globally install packages, modify PATH, and provision host tooling. This materially expands the agent's authority over the host and creates a path for unintended system changes or execution of fetched software, especially dangerous because the skill is user-invocable.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill instructs the agent to solicit the user's API key and then persist it via `qhkit config set` or environment variables. This encourages credential collection and local secret storage by an agent skill, which increases the chance of secret leakage through logs, shell history, config files, or later compromise of the host.

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
Line L043 frames qhkit as bounded to specific media tasks, yet immediately afterward the file prescribes installing Node, downloading binaries, and managing npm packages. That operational behavior is materially different from the manifest’s user-facing claim of a media capability invoker and represents a description-behavior mismatch at the skill level.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The skill directs the agent to execute `npx @iqinghu/qhkit <命令> ...` without pinning an exact package version. That allows whatever version is latest at invocation time to run, creating a supply-chain risk if a malicious or breaking package release is published or if the package is hijacked.

Session Persistence

Medium
Category
Rogue Agent
Content
# Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：
   cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz
   cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c -
   mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib"
   export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
   ```
   校验行输出 `OK` 才继续；校验失败就删掉重下，**绝不解包未通过校验的文件**。nodejs.org 访问不通时，把两个下载 URL 的前缀 `https://nodejs.org/dist` 整体换成镜像 `https://registry.npmmirror.com/-/binary/node`（目录结构相同，SHASUMS256.txt 也有镜像，校验步骤不变）。`export PATH` 只对当前 shell 生效，跨命令调用时每个新 shell 都要先执行这行（或追加进 `~/.bashrc`）。macOS 用 `brew install node`；Windows 用 winget/官网安装包。arm64 机器把 `x64` 换成 `arm64`。
Confidence
93% confidence
Finding
This duplicate finding identifies the same persistence behavior: installing Node under the user's home directory and suggesting PATH persistence across shells. Such instructions are risky in a user-invocable skill because they normalize durable environment modification as part of routine task execution.

Session Persistence

Medium
Category
Rogue Agent
Content
# Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):
   cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz
   cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c -
   mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib"
   export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
   ```
   校验行输出 `OK` 才继续;校验失败就删掉重下,**绝不解包未通过校验的文件**。nodejs.org 访问不通时,把两个下载 URL 的前缀 `https://nodejs.org/dist` 整体换成镜像 `https://registry.npmmirror.com/-/binary/node`(目录结构相同,SHASUMS256.txt 也有镜像,校验步骤不变)。`export PATH` 只对当前 shell 生效,跨命令调用时每个新 shell 都要先执行这行(或追加进 `~/.bashrc`)。macOS 用 `brew install node`;Windows 用 winget/官网安装包。arm64 机器把 `x64` 换成 `arm64`。
Confidence
93% confidence
Finding
This duplicate finding identifies the same persistence behavior: installing Node under the user's home directory and suggesting PATH persistence across shells. Such instructions are risky in a user-invocable skill because they normalize durable environment modification as part of routine task execution.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
These instructions go beyond merely invoking Qinghu media APIs: the agent is told to fetch external images, install image-processing dependencies, and transform local files before retrying. That local file manipulation is an extra operational capability not clearly stated in the manifest’s purpose description.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The workflow falls back to `npx --yes sharp-cli` without an exact version, which downloads and runs remote code on demand. In a security-sensitive agent environment, unpinned transient installs increase exposure to supply-chain compromise and non-reproducible behavior.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The delivery format requires a '简短中文名' for artifacts, which imposes a specific language in user-facing output. The document does not provide an opt-in choice for language or explain that the skill is restricted to a Chinese-only deployment context.

Static analysis

No suspicious patterns detected.