Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent ad-image generation purpose, but its setup instructions can install and update remote tooling, alter the user's environment, and store service credentials with limited user-control boundaries.
Install only if you are comfortable letting the skill set up qhkit/Node tooling and configure a Qinghu API token. Prefer using an already-installed, reviewed qhkit version, avoid unpinned npx or @latest upgrades unless you approve them, and review any PATH or shell-profile changes before allowing them.
The trigger text says the skill must fire whenever users ask for broad classes of common content such as promotional images, notes, and creative assets. Overly broad mandatory triggering can cause unnecessary invocation of a tool-capable skill, increasing the chance that installation steps, credential prompts, or external calls occur in contexts where a simpler non-tool response would suffice.
The trigger examples blur boundaries between this skill and neighboring poster/video skills, which can lead to accidental activation of the wrong workflow. In a tool-using agent, ambiguous routing increases the odds of unnecessary external command execution or credential/setup prompts for requests that may belong to safer or simpler skills.
The skill includes extensive environment bootstrapping, package installation, Node installation, mirror switching, token configuration, and upgrade instructions that go far beyond simple ad-asset generation. This materially expands the attack surface by encouraging the agent to modify the host environment, install network-fetched software, and persist configuration in order to satisfy ordinary content-generation requests.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning a specific version, which can fetch and run whatever package version is current at execution time. That creates a supply-chain risk and makes behavior non-deterministic, especially because the package is executed directly rather than only installed for later review.
This finding is substantively the same persistence issue: the skill directs the agent to unpack binaries into a user-controlled location and export a modified PATH so future commands resolve to that runtime. That persistence is not necessary for the core business task and enables durable environment changes that can outlive the current session.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This finding is substantively the same persistence issue: the skill directs the agent to unpack binaries into a user-controlled location and export a modified PATH so future commands resolve to that runtime. That persistence is not necessary for the core business task and enables durable environment changes that can outlive the current session.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"