Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Qinghu two-person video generation helper that uses qhkit and user-provided media, with no hidden destructive or unrelated behavior found.
Before installing, confirm you are comfortable installing qhkit/Node, storing a Qinghu API token, uploading the chosen videos/images to Qinghu, and spending Qinghu credits. Prefer a pinned or already-reviewed qhkit version where possible.
The description says the skill 'must trigger' whenever a user wants a two-person promotional video, imitation shoot, parent-child/partner scene, or synchronized dual-person motion. Several of these phrases are broad creative intents rather than narrow invocation cues, which increases the chance of unintended activation for ordinary video-editing requests.
The '何时触发' section lists short natural-language examples like '帮我仿拍' and '亲子 / 搭档出镜' without defining when similar requests should not use this skill. Because the section does not provide exclusion conditions or a complete trigger scope, nearby everyday requests could collide with this skill.
The file instructs the agent to relay the CLI message '原样转告用户' and later states the CLI message is already '面向用户的中文'. This imposes a Chinese-language response path regardless of the user's preferred language, which is a locale/language policy issue absent any opt-in or justified region-only constraint for user communication.
The skill instructs falling back to npx @iqinghu/qhkit without pinning a version, which makes execution depend on whatever package version is latest at runtime. That creates a supply-chain risk: behavior can change unexpectedly, and a compromised or malicious newly published version could be fetched and executed automatically.
This duplicated finding points to the same behavior: unpacking software into a user-controlled persistent directory and exporting a modified PATH. In an agent context, persistent host modifications increase the blast radius of mistakes and can leave behind executables that affect later sessions or commands.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same behavior: unpacking software into a user-controlled persistent directory and exporting a modified PATH. In an agent context, persistent host modifications increase the blast radius of mistakes and can leave behind executables that affect later sessions or commands.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill mandates a specific final output line in Chinese ('本次共消耗 ... 青虎积分') with rigid formatting. This is a natural-language policy concern because it forces a specific language in the response without offering localization based on user preference.