Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid image-enhancement workflow, but users should be aware it can install a CLI, use an API token, and upload images to an external service.
Install only if you are comfortable using Qinghu's paid image workflow, uploading the chosen image to that service, and configuring a qhkit token. Confirm costs before generation, avoid using sensitive or unauthorized images, and prefer explicit approval before installing or upgrading Node/qhkit.
The activation description includes broad natural-language triggers such as requests to make an image 'more realistic' or '高清', which are common in ordinary conversation. Overbroad invocation criteria can cause the skill to trigger unexpectedly and steer the agent into installing software, requesting credentials, or initiating paid workflows without sufficiently explicit user intent.
The '何时触发' examples are ambiguous and lack limiting conditions, so ordinary image-editing requests could invoke this skill unintentionally. In this skill's context, accidental activation is more dangerous because the skill then guides installation, token setup, pricing checks, and external workflow execution.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which makes execution depend on whatever package version is current at runtime. This creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be fetched and executed automatically in the user's environment.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"