AI电商带货视频 | 口播视频 | 商品促销视频 | 商品测评视频 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:22 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent ecommerce video purpose, but it asks agents to install and run a mutable global CLI and follow upgrade instructions from runtime output, which deserves user review before installation.

Install only if you trust the @iqinghu/qhkit npm package and the Qinghu service with the media and prompts you provide. Prefer running it in an isolated environment, pinning the CLI version, reviewing any install or upgrade command before execution, and confirming expected credit charges before submitting a generation task.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:57
• Finding: Unpinned Installation and Execution of a Third-Party CLI Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57-63; related upgrade instruction at lines 84-88 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High ### Evidence ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit execution through an unpinned package reference: ```bash npx @iqinghu/qhkit <command> ... ``` The related upgrade procedure explicitly selects the newest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill requires installation and execution of the third-party `@iqinghu/qhkit` npm package, but it does not pin the package to a reviewed version or verify package integrity against an independently maintained digest. Both the default npm installation and the documented mirror fallback resolve package contents at installation time. The use of `npx` has the same underlying risk because it can download and execute the package dynamically. The `@latest` upgrade instruction expressly permits package contents to change after this Skill has been audited. The package source is not included in the reviewed project. Consequently, this audit cannot verify its lifecycle scripts, local file access, token handling, media-upload behavior, API endpoints, or other runtime actions. An npm package may execute code during installation through lifecycle hooks and later when its CLI is invoked. Global installation also exceeds the minimum practical scope required for an individual video-generation task. It modifies the user's global Node.js tool environment rather than using a project-local, isolated dependency. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, configured npm registry, or mirror serving `@iqinghu/qhkit`. 2. The attacker publishes a malicious version under the existing package name or causes the mutable `latest` tag to resolve to a malicious release. 3. The Agent follows the Skill's bootstrap or upgrade ...[truncated 1420 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific version that has been reviewed: ```bash npm install --save-exact @iqinghu/qhkit@X.Y.Z ``` 2. Record and validate the expected package integrity value using a lockfile or a separately maintained SHA-512 digest. 3. Remove the use of `@latest` and do not upgrade automatically. Require a new security review before changing the permitted version. 4. Avoid global installation. Install the package in a dedicated, minimally privileged project directory or isolated container. 5. Avoid `npx` with an unpinned package. If it must be used, specify an exact reviewed version. 6. Disable npm lifecycle scripts where compatible: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@X.Y.Z ``` 7. Use only a trusted registry configured by the operator. Do not silently switch registries or mirrors. 8. Obtain explicit user approval before installing executable dependencies, uploading local media, or submitting a paid generation job. 9. Run the CLI with restricted filesystem and network access and expose only the media files required for the current task. 10. Document where the token is stored, ensure restrictive file permissions, and pass a narrowly scoped or short-lived token when supported. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:84
• Finding: Execution of Upgrade Commands Selected by Runtime-Controlled CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 84 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Evidence The Skill instructs the Agent that when the CLI returns a version-stage failure, the response message contains the upgrade command and that the Agent should execute that command as instructed. English rendering of the relevant instruction: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as instructed. ``` ### Technical Analysis This instruction delegates shell-command selection to runtime output produced by the installed CLI or its remote backend. That output is not a trusted, fixed command definition in the reviewed Skill. Although the document later shows a specific npm upgrade command, the earlier instruction is broader: it tells the Agent to follow the command contained in the returned message. A compromised package, manipulated service response, spoofed local executable, or malicious registry release could return a message containing arbitrary shell syntax. Treating diagnostic text as executable instructions crosses the boundary between untrusted data and commands. The Agent should parse only structured status data and choose actions from a fixed allowlist established in the reviewed Skill. ### Attack Path 1. An attacker compromises or replaces the `qhkit` executable, compromises its backend response path, or introduces a malicious dependency release. 2. The manipulated component returns a response with `stage` set to `version`. 3. The response's `message` field contains an attacker-selected command, such as a command that downloads another payload, reads credentials, or modifies local files. 4. The Agent follows the Skill's instruction to execute the command from the message. 5. The attacker-selected command runs with the privileges and environment of the Agent account. 6. The command can access local media, API ...[truncated 654 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove any instruction to execute commands contained in CLI output, error messages, API responses, or other runtime-controlled text. 2. Define a strict allowlist of fixed maintenance commands in the reviewed Skill. 3. Permit only an exact, pinned upgrade command, and validate every argument before execution. 4. Require explicit user confirmation before any installation or upgrade. 5. Treat the `message` field strictly as display-only diagnostic data. 6. Parse structured fields such as `stage` and error codes without interpreting free-form text as shell commands. 7. Reject shell metacharacters, unexpected arguments, alternate registries, URLs, and package names in any suggested maintenance action. 8. Execute approved maintenance operations without invoking a shell where possible, using a process API with a fixed executable and argument array. 9. Log the installed version, target version, registry, integrity digest, and user approval for each upgrade. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The manifest declares that when users ask to generate or make nearly any kind of video, the skill 'must' trigger. This is an overly broad routing rule that can hijack general video-related requests, reducing user choice and causing the agent to invoke external tooling in situations where a narrower match or explicit confirmation would be safer.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The guidance says that generic requests like '做视频' should enter this skill after asking a few clarifying questions. That still biases ambiguous, broad user intents toward this specific external skill, creating an unsafe default routing behavior and increasing the chance of unintended invocation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The instruction states that CLI error messages are already user-facing Chinese and should be relayed verbatim, which implicitly constrains output language regardless of the user's preference. This can override the agent's normal language adaptation, degrade usability, and create a prompt-routing conflict when serving non-Chinese-speaking users.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The failure-handling instruction explicitly says to relay the CLI message, which the document characterizes as user-facing Chinese. This effectively enforces Chinese-only failure communication and can mislead or exclude users who did not opt into Chinese, especially during important billing, moderation, or installation failures.

Static analysis

No suspicious patterns detected.