AI生成电商图 | 电商主图 | 电商详情图 | 电商白底图 | 电商活动图 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:22 AM UTC
• Version: 0.1.0

Overview

The skill's image-generation purpose is coherent, but its install and upgrade instructions give mutable third-party CLI code too much unsafeguarded authority.

Install only if you trust the qhkit npm package and Qinghu service. Prefer a pinned reviewed CLI version, avoid executing upgrade commands copied from CLI messages, protect the API token, and run it in a constrained environment because product images will be uploaded to the provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:56
• Finding: Unpinned Global Installation and Execution of a Mutable Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:56-61` and `SKILL.md:82-86` **Vulnerability Type**: Uncontrolled third-party dependency installation **Risk Level**: High ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The Skill also permits execution through an unpinned package reference: ```bash npx @iqinghu/qhkit <command> ... ``` The automatic upgrade procedure explicitly installs the current mutable release: ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions additionally permit the following alternate registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute `@iqinghu/qhkit` without pinning a reviewed version or verifying package integrity. The `@latest` upgrade command explicitly resolves to package contents that can change after this Skill has been audited. Global npm installation is especially sensitive because npm packages may run lifecycle scripts during installation. Such scripts execute with the privileges of the Agent process and can access files, environment variables, network resources, and user-level configuration available to that process. Allowing fallback to another registry expands the supply-chain trust boundary. Although the named mirror may be legitimate, the Skill does not require equivalent cryptographic package-integrity validation before executing packages retrieved through it. Installing the package globally is broader than the minimum privileges required to invoke a CLI. A pinned, isolated, user-local execution environment would reduce both modification scope and persistence. ### Attack Path 1. An attacker compromises the npm publisher account, a package release, a registry, a configured mirror, or another part of the package distribution chain. 2. The attacker publishes a malicious version as the current default or latest release. 3. The Agent detects that `qhkit` is unavailable or follows the documen ...[truncated 1111 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed: ```bash npm install --global @iqinghu/qhkit@<reviewed-exact-version> ``` 2. Do not use `@latest` in an Agent-controlled automatic upgrade workflow. 3. Record and verify npm package integrity through a lockfile or an independently maintained cryptographic digest. 4. Prefer a project-local installation or isolated execution environment over global installation. 5. Disable npm lifecycle scripts where compatible: ```bash npm install --ignore-scripts ... ``` If lifecycle scripts are required, review them explicitly before installation. 6. Run the CLI in a sandbox with restricted filesystem, environment-variable, credential, and network access. 7. Require explicit user approval before installing or upgrading executable dependencies. 8. Apply the same version and integrity requirements to every registry or mirror. Do not silently switch package sources. 9. Document the exact reviewed package version and a controlled process for reviewing and approving updates. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:79
• Finding: Execution of Upgrade Commands Supplied Through Remote-Controlled CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:79-81` **Vulnerability Type**: Unvalidated command execution from CLI response content **Risk Level**: High ### Complete Code Snippet The upgrade instructions state that when the CLI returns a version-stage failure, the response message contains the upgrade command and the Agent should execute it exactly: ```text The command returns {"ok":false,"stage":"version",...}; the message contains the upgrade command; execute it exactly. ``` The locally documented upgrade command is: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill treats text contained in a CLI response as trusted executable instructions. The response may be influenced by the installed CLI package or its remote service. It is therefore data crossing a trust boundary and must not be interpreted directly as a shell command. Checking only that the response contains `stage:"version"` does not make the associated message trustworthy. A compromised package, service, network dependency, or service account could return the expected stage while embedding arbitrary shell syntax in the message. This creates a command-execution channel in which the effective command is not fixed in the reviewed Skill. The message could contain shell operators, command substitutions, redirections, or commands unrelated to package upgrades. Following the instruction to execute the message exactly would bypass local command validation. ### Attack Path 1. An attacker compromises the `qhkit` package, its backing service, or another component able to control the CLI response. 2. The attacker returns a response shaped like a legitimate version-gate error: ```json {"ok":false,"stage":"version","message":"<attacker-controlled command>"} ``` 3. The Agent recognizes the documented `version` stage. 4. Following the Skill instructions, the Agent treats the `message` value as an upgrade command and executes it exactly. 5. The attacker- ...[truncated 1113 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never execute command text obtained from a CLI response, error message, API response, or other remote-controlled content. 2. Treat the response message only as displayable diagnostic data. 3. Map recognized response stages to locally defined actions. For example, a `version` stage may select a hard-coded, pinned update command. 4. Validate the full response structure and use a strict allowlist of accepted stage values. 5. Pin upgrades to a reviewed exact version rather than using `@latest`. 6. Require explicit user confirmation before any installation or upgrade. 7. Invoke package-management tools directly with structured arguments rather than passing response text through a shell. 8. Reject any suggested command containing shell operators, substitutions, redirections, newlines, or unexpected arguments. 9. Run update operations in a restricted sandbox without unnecessary access to user files, secrets, or privileged system locations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger definition is extremely broad and uses mandatory language, causing the skill to activate for many common image-related ecommerce requests without clear guardrails. In an agentic system, overbroad routing can misdirect user tasks, suppress more appropriate skills, and increase the chance of unintended tool use or unnecessary external service calls.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs operators to pass an API token directly on the command line or via environment variable without any credential-safety guidance. Command-line tokens can leak through shell history, process listings, logs, or transcripts, which is especially risky in shared, monitored, or agent-executed environments.

Static analysis

No suspicious patterns detected.