Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed image-erasing workflow for Qinghu/qhkit, with notable setup and authorization cautions but no artifact-backed malicious behavior.
Install only if you are comfortable trusting the qhkit npm package and sending selected images to the Qinghu service. Use it for images you own or are authorized to edit, especially for watermark or text removal, and prefer user-confirmed installs instead of automatic global npm, npx, or shell-startup PATH changes.
The trigger description is broad enough to activate on common image-cleanup requests such as removing text, people, or clutter, which can pull the agent into high-risk editing flows unnecessarily. In this skill’s context, that is more dangerous because the same broad phrasing explicitly includes watermark removal, a misuse-prone capability that may violate policy or user rights.
The invocation examples use generic phrases like removing watermarks, text, passersby, or clutter without enough constraints, which can cause over-triggering and normalize risky image manipulation requests. Because the examples are operational guidance, they increase the chance the agent executes sensitive edits without first validating legitimacy or user authorization.
The skill instructs fallback execution via npx @iqinghu/qhkit <命令> ... without pinning a specific version. That allows whatever package version is current at execution time to be fetched and run, which weakens supply-chain integrity and can unexpectedly introduce malicious or breaking changes into the agent environment.
This duplicate finding points to the same persistence behavior: unpacking Node into a user directory and exporting a modified PATH, with optional persistence across shells. In a skill file, such instructions are dangerous because they encourage long-lived environmental changes unrelated to the immediate image-editing task and can affect future tool execution.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node into a user directory and exporting a modified PATH, with optional persistence across shells. In a skill file, such instructions are dangerous because they encourage long-lived environmental changes unrelated to the immediate image-editing task and can affect future tool execution.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions require relaying messages to the user as Chinese and describe them as user-facing Chinese output, but do not provide an option to match the user's preferred language. This creates a locale/language policy concern because the skill appears to mandate a specific language without opt-in.