商品图消除 | 去水印 | 去除杂物 | 智能擦除 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:22 AM UTC
• Version: 0.1.0

Overview

The skill’s image-erasing purpose is clear, but its setup and update instructions give a third-party CLI broad local execution and persistence with insufficient safeguards.

Review this before installing. Only use it if you trust the @iqinghu/qhkit package and Qinghu service, are comfortable uploading selected images to that service, and can manage the API token safely. Prefer a pinned, local, sandboxed installation and do not run upgrade commands copied from tool output without independent verification.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42
• Finding: Mutable Third-Party Package Is Installed and Executed Globally## Vulnerability Details **File Location**: `SKILL.md`, lines 42-45 and 63-66 **Vulnerability Type**: Mutable and globally installed third-party dependency **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The instructions permit execution through `npx` and fallback to the `registry.npmmirror.com` mirror. They also prescribe an unpinned upgrade: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning an audited version or validating the package against a known integrity digest. The `@latest` selector explicitly allows the effective executable code to change after this Skill has been reviewed. A global npm installation may run package lifecycle scripts and place executable files in a shared command path. This grants the package the privileges of the user running npm and exposes other sessions to the installed executable. Global installation is broader than necessary because a project-local, version-pinned installation could provide the declared image-processing functionality. The mirror fallback introduces another distribution endpoint into the trust chain. Although the named mirror is not inherently malicious, automatically changing registries expands the supply-chain attack surface unless the package artifact is independently authenticated. ### Attack Path 1. An attacker compromises the package publisher account, npm release process, package dependency tree, or permitted mirror. 2. The attacker publishes or serves a malicious release under the expected package name or mutable `latest` tag. 3. The agent follows `SKILL.md` and runs the global installation or invokes the package through `npx`. 4. Malicious lifecycle scripts or CLI code execute with the permissions of the current user. 5. The malicious package can access files, environment variables, network resources, and credentials available to that user and ca ...[truncated 705 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an unversioned package or `@latest`. 2. Record and verify the package integrity digest from a trusted lockfile before execution. 3. Prefer a project-local installation in an isolated directory instead of a global installation. 4. Use `npm ci` with a committed lockfile where possible. 5. Disable npm lifecycle scripts during installation when the package can function without them, then invoke only the explicitly reviewed executable. 6. Do not use `npx` in a way that implicitly downloads a mutable package at execution time. 7. Require explicit user approval before changing registries, and independently verify artifacts retrieved through a mirror. 8. Run the CLI in a sandbox with access limited to the selected input image, its output directory, and the minimum required network destinations.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:60
• Finding: CLI or Backend Response Can Direct the Agent to Execute an Upgrade Command## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Execution guidance controlled by an external tool response **Risk Level**: High ### Vulnerable Instruction The following is an English translation of the instruction at line 60: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; follow it directly. ``` ### Technical Analysis This instruction treats a CLI response field as trusted executable guidance. The contents of `message` may be influenced by the locally installed package or by the remote service with which that package communicates. Instructing the agent to follow a returned command directly crosses a critical trust boundary: external data is converted into an agent action without syntax validation, command allowlisting, or user confirmation. The document separately provides a fixed npm upgrade command, but the vulnerable instruction does not restrict execution to that command. Consequently, a compromised CLI package or backend could return shell syntax unrelated to a legitimate upgrade. ### Attack Path 1. An attacker compromises the `qhkit` package, one of its dependencies, its update/version endpoint, or the associated backend. 2. The compromised component returns a version-stage error whose `message` field contains a malicious command disguised as upgrade guidance. 3. The agent interprets the response according to line 60 and follows the command directly. 4. The command executes in the local environment with the agent user's privileges. 5. The attacker can then read or modify accessible files, steal environment credentials, install additional software, or establish further access within the user's permission boundary. ### Impact Assessment Exploitation may result in arbitrary command execution with the current user's privileges. The accessible scope can include user files, shell configuration, API tokens, project ...[truncated 370 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction to execute commands contained in `message`, standard output, standard error, or any backend-controlled field. 2. Treat response messages only as untrusted diagnostic text to display after removing sensitive local details. 3. Define a local allowlist of permitted upgrade operations and require an exact match against the expected package name and a pinned target version. 4. Construct the upgrade operation from trusted local constants rather than evaluating or copying response text. 5. Reject shell metacharacters, additional arguments, alternate registries, command substitution, redirection, and chained commands. 6. Require explicit user approval before performing any installation or upgrade. 7. Perform approved upgrades in a restricted environment and verify the downloaded package's integrity before execution.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The metadata description says the skill 'must trigger' for broad classes of requests like removing elements, watermarks, text, clutter, or cleaning images, without meaningful exclusions or eligibility checks. This can cause over-activation on common image-editing prompts, leading the agent to route users into a third-party tool unexpectedly, including for sensitive or policy-relevant requests such as watermark removal.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The '何时触发' section uses only broad sample utterances like removing watermarks, passersby, text, or leaving only the product, but does not define boundaries, consent checks, or when not to invoke the skill. In practice this increases the chance of unintended activation on routine conversations and steers the agent toward a powerful image-alteration workflow without sufficient scoping.

Static analysis

No suspicious patterns detected.