电商详情图生成 | 详情页长图 | 卖点图 | 高转化详情 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:22 AM UTC
• Version: 0.1.0

Overview

The skill does what it claims, but its setup and upgrade instructions give too much control to a third-party CLI and remote messages.

Review before installing. Use this skill only if you are comfortable with qhkit uploading product images to Qinghu, consuming account credits, and installing third-party npm tooling. Prefer a pinned, local installation, avoid executing upgrade commands copied from CLI messages, and provide tokens through a safer secret mechanism rather than typing them into command arguments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:61
• Finding: Blind Execution of Remotely Influenced Upgrade Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote command injection through trusted runtime messages **Risk Level**: High ### Vulnerable Code Snippet Translated instruction preserving the source meaning: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it exactly as provided. ``` ### Technical Analysis The Skill directs the agent to execute an upgrade command supplied through the CLI's runtime `message` field without validating the command against a fixed allowlist. This converts output controlled by the installed CLI or its remote backend into a shell command-execution channel. Although version upgrades are relevant to maintaining the CLI, accepting arbitrary command text from a runtime response is not necessary. The Skill can instead define a fixed, reviewed upgrade operation locally. Trusting a message as executable code violates the separation between untrusted data and shell instructions. The dangerous behavior requires the agent to interpret and follow the message rather than being an automatic shell-level injection. Nevertheless, the instruction explicitly directs that behavior, making a compromised package or service response capable of influencing local command execution. ### Attack Path 1. An attacker compromises the `@iqinghu/qhkit` package, its distribution account, update infrastructure, or the backend that supplies version-gate messages. 2. The compromised component returns a response with `stage` set to `version`. 3. The response's `message` field contains an attacker-selected shell command rather than a legitimate upgrade command. 4. Following the Skill instruction, the agent executes the command exactly as provided. 5. The command runs with the same OS identity and environment access as the agent. ### Impact Assessment Successful exploitation permits arbitrary command execution within the agent process's existing ...[truncated 554 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never execute shell commands copied from CLI output, service responses, error messages, or other runtime-controlled text. - Treat the `message` field exclusively as displayable diagnostic data. - Replace the instruction with a locally defined and strictly allowlisted upgrade command. - Pin upgrades to a reviewed package version instead of accepting an arbitrary or latest version. - Require explicit user approval before installing or upgrading executable dependencies. - Validate package provenance and integrity before execution. - Perform dependency installation in an isolated, unprivileged environment with restricted filesystem and credential access. - If a version-gate response is received, display the diagnostic message after escaping it and separately offer the fixed, locally approved upgrade action. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41
• Finding: Unpinned Global Installation and Execution of a Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41 and 64 **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs an executable third-party npm package globally without pinning it to an audited version or verifying a package integrity digest. The explicit use of the `latest` tag further permits the installed code to change after the Skill itself has been reviewed. npm packages can execute code through lifecycle scripts during installation and through the installed CLI at runtime. Consequently, trust is delegated to the package publisher, npm account security, package registry, and any configured fallback registry. A compromised publisher account, malicious release, or supply-chain incident could introduce arbitrary executable behavior. Global installation also broadens the change beyond the current task or project. It modifies the user's shared command environment and can affect future sessions, whereas a local, isolated installation would be sufficient for the declared image-generation functionality. ### Attack Path 1. An attacker compromises the package publisher, registry account, release pipeline, or a relevant package dependency. 2. The attacker publishes a malicious version under the expected package name or causes the `latest` tag to resolve to that version. 3. The agent runs one of the documented global installation commands. 4. Malicious lifecycle code may execute during installation, or malicious code executes when the `qhkit` command is invoked. 5. The package gains access to the files, environment variables, network connectivity, and credentials available to the installing user. ### Impact Assessment Exploitation could result in arbitrary code execution with the privileges of the user running npm. Accessible project fil ...[truncated 477 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specific reviewed version rather than using an implicit version or `@latest`. - Record and verify the expected npm integrity digest and package provenance. - Use a project-local or temporary isolated installation instead of a global installation. - Execute the package under an unprivileged account or sandbox with access limited to required input and output files. - Disable npm lifecycle scripts with `--ignore-scripts` where compatible; otherwise, review all lifecycle scripts before installation. - Require explicit user approval before any dependency installation or upgrade. - Do not automatically switch registries without informing the user and validating equivalent package integrity. - Re-review the package before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 56 **Vulnerability Type**: Sensitive credential exposure in process arguments and shell history **Risk Level**: Medium ### Vulnerable Code Snippet ```bash qhkit config set --token <secret> --env prod ``` ### Technical Analysis The documented configuration method places the API token directly in a command-line argument. Command arguments can be exposed through shell history, process inspection utilities, terminal capture, command auditing, debugging logs, agent transcripts, and orchestration telemetry. The token is necessary to authenticate to the remote service, but exposing it in the process argument vector is not necessary. A protected standard-input flow, secret manager, restricted configuration file, or securely injected environment variable can reduce exposure. The Skill also offers `QHKIT_TOKEN` as an alternative. Environment variables are still visible to the process and potentially to child processes or diagnostic tooling, but they avoid routine shell-history and command-line exposure when injected securely. ### Attack Path 1. A user or agent substitutes a real API token into the documented command. 2. The shell records the command in history, or local monitoring and logging capture the process arguments. 3. Another local user, support operator, log consumer, or compromised process reads the recorded token. 4. The attacker submits authenticated requests using the stolen token. 5. The attack continues until the token is revoked, rotated, expires, or is otherwise invalidated. ### Impact Assessment A stolen token may allow unauthorized use of the Qinghu account and consumption of its credits. Depending on the service-side permissions associated with the token, it may also expose account metadata, generated assets, task history, or other API-accessible resources. This does not directly grant operating-system privileges. Its scope is principally the remote service account and an ...[truncated 64 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer a CLI option that reads the token from protected standard input without echoing it. - Alternatively, retrieve the token from an OS credential store or dedicated secret manager. - If an environment variable must be used, inject it without embedding the value in shell commands, scripts, or transcript-visible text. - Avoid logging commands containing secrets and apply automatic token redaction to agent and subprocess logs. - Store persistent configuration with owner-only permissions, such as mode `0600` on supported systems. - Prevent the token from being inherited by unrelated child processes. - Document immediate token rotation and revocation procedures for suspected exposure. - Ensure diagnostic commands display only redacted token values. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger definition is explicitly mandatory for broad, common requests like generating product detail images, long images, and marketing image sets, without meaningful exclusions or confirmation gates. This can cause the agent to invoke an external tool unnecessarily or too eagerly, increasing the chance of unintended third-party data sharing, unwanted installs/configuration changes, and execution of side-effecting commands.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The activation examples are broad and loosely phrased, which makes the skill likely to match ordinary design-assistance requests that may not actually require this specific tool. In context, that ambiguity raises the risk of over-triggering a networked CLI that uploads local images and may prompt environment setup, even when simpler or safer handling would suffice.

Static analysis

No suspicious patterns detected.