电商背景替换 | 换背景 | 一键替换背景 | 场景合成 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:21 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent image-background purpose, but its setup and upgrade instructions can cause broad local software changes and may execute upgrade commands supplied by external CLI output.

Review this before installing. It may be useful if you trust the qhkit service and need product background generation, but only allow installs or upgrades after explicit confirmation, avoid running dynamic commands from CLI messages, prefer a pinned reviewed package version, and use a narrowly scoped token and working directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6
• Finding: Mutable Third-Party CLI Is Installed and Executed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6 and 40–63 **Vulnerability Type**: Supply-chain exposure through unpinned npm installation **Risk Level**: Medium ### Relevant Code Snippet ```yaml metadata: {"openclaw":{"emoji":"🪄","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The instructions also allow direct execution through `npx`: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly retrieves the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes the external `@iqinghu/qhkit` npm package without pinning an audited version or verifying package integrity. The `@latest` upgrade command intentionally resolves to a mutable release that may change after this Skill has been reviewed. The `npx` fallback can also download and immediately execute the package when it is not already available locally. Depending on npm configuration, package lifecycle scripts and the installed CLI execute with the permissions of the user running the Agent. The instructions additionally permit use of `registry.npmmirror.com` as a fallback registry. Although described as a mirror, this introduces another supply-chain trust boundary. No package digest, lockfile, signature, provenance attestation, or approved-version allowlist is required. The dependency appears necessary for the declared image-generation functionality, but global installation, mutable version selection, and immediate execution exceed the minimum-risk installation approach. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, a newly published release, or a configured registry response. 2. The attacker publishes malicious package code under the expected package name or compromises the release selected by the mutable version constraint. 3. The Agent follows the Skil ...[truncated 1066 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an unqualified package name or `@latest`. 2. Record and verify the package integrity digest, such as the npm `dist.integrity` value, before execution. 3. Remove the instruction to execute the package directly through an unpinned `npx` invocation. 4. Prefer a project-local installation controlled by a lockfile instead of a global installation. 5. Disable npm lifecycle scripts with `--ignore-scripts` when compatible with the package. 6. Use only explicitly approved registries and validate that fallback mirrors provide the expected integrity metadata. 7. Run the CLI in a restricted environment with access only to required input files, output locations, network destinations, and credentials. 8. Do not install with administrator or root privileges. If the package cannot be installed without elevation, stop and request a safer pre-provisioned environment. 9. Review and approve each new package version before updating the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60
• Finding: CLI Response Text May Be Treated as a Shell Upgrade Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60–63 **Vulnerability Type**: Command injection through dynamically supplied upgrade instructions **Risk Level**: High ### Relevant Instruction Snippet The source instruction states, translated into English: ```text Upgrade: When the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as instructed. ``` A static upgrade command is subsequently shown: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to execute an upgrade command obtained from the CLI's `message` field. That field is dynamic output rather than trusted, static Skill configuration. No parsing, command allowlist, package-name validation, version validation, shell metacharacter rejection, or user confirmation is required before execution. If the CLI, its backing service, the package itself, or its communication path is compromised, an attacker could place arbitrary shell syntax in the message. The static npm command shown after the instruction does not eliminate the issue because the preceding instruction explicitly says to follow the command contained in the message. An Agent could therefore treat untrusted text as executable instructions rather than displaying it as data. Executing service or CLI response text is unnecessary for the declared background-replacement functionality and violates the principle that external output must be treated as untrusted data. ### Attack Path 1. An attacker compromises the installed CLI package, the service that supplies version-gate responses, or another component capable of influencing the returned `message`. 2. The attacker returns a response resembling: ```json {"ok":false,"stage":"version","message":"<attacker-controlled shell command>"} ``` 3. The Agent follows the Skill's instruction to execute the upgrade command contained in `message`. 4. The attacker-controlled comm ...[truncated 1058 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute any command found in a CLI or service response. 2. Treat the `message` field exclusively as untrusted display text. 3. Replace dynamic command execution with a hard-coded upgrade routine that permits only an approved package name and pinned version. 4. Parse version responses as structured data and validate the requested version against a strict allowlist. 5. Reject shell metacharacters, additional arguments, URLs, alternate package names, and registry overrides. 6. Require explicit user confirmation before any package installation or upgrade. 7. Avoid invoking a shell where possible; call the package manager with a fixed executable and a fixed argument array. 8. Log the validated package name, version, registry, and integrity digest before installation. 9. Run upgrades without elevated privileges and in a sandbox that does not expose unrelated files or credentials. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes extensive environment bootstrapping and system-configuration instructions: installing Node, globally installing an npm package, changing PATH, and configuring API tokens. For a background-replacement skill, this materially expands the action surface from image editing into software installation and credential handling, which can lead to unintended system changes or secret exposure if an agent follows it automatically.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger text says the skill 'must' activate for a wide range of common image-editing requests, making invocation overly broad. This increases the chance that the agent routes unrelated or ambiguous user requests into a tool that can install software, configure credentials, and call an external service, causing unnecessary exposure and side effects.

Static analysis

No suspicious patterns detected.