Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Qinghu video-generation workflow that uses user-provided media and a paid API, with no evidence of hidden or destructive behavior.
Install only if you are comfortable sending the selected model, clothing, and optional audio files to Qinghu's service and using Qinghu credits. Review the qhkit package source/provenance if supply-chain pinning matters in your environment, and avoid adding PATH changes permanently unless you intend to keep the local Node installation.
The metadata description says this skill 'must trigger' for broad user intents such as outfit-change and fashion video creation. Overly broad mandatory invocation can cause the agent to route users into this skill even when the request is only loosely related, leading to unintended execution of external tooling and unnecessary collection or handling of user media.
The example triggers are phrased broadly, such as '做一条开门换装视频' or '一个模特换几套衣服的那种视频', without clear exclusion conditions. In skill-routing systems, ambiguous examples can misfire and invoke this workflow for adjacent editing or styling requests, causing unintended third-party API usage and cost-incurring actions.
The skill recommends falling back to npx @iqinghu/qhkit <命令> ... without pinning an exact package version. That allows execution of whatever version is current in the registry at runtime, increasing supply-chain risk and reducing reproducibility if a compromised or breaking release is published.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"