Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent image-generation integration, but users should understand it installs and runs an external CLI, uses an API token, and uploads prompts or reference images to Qinghu AI.
Install only if you are comfortable using Qinghu AI’s external service, installing/running the qhkit npm CLI, and providing a Qinghu API token. Treat reference images and prompts as data sent to that service, and prefer user-scoped, reviewed installation rather than blindly upgrading to latest versions in sensitive environments.
The metadata description says image-generation requests 'must trigger' this skill for broad classes of user prompts. Overly broad mandatory triggering can cause the agent to invoke external tooling in situations where clarification, policy checks, or a different safer skill would be more appropriate, increasing the chance of unintended data handling or unnecessary external calls.
The fallback trigger for 'other freeform image-editing/generation needs' is ambiguous and effectively acts as a catch-all. This can route loosely related tasks into this skill without clear boundaries, increasing the risk of inappropriate tool invocation and accidental transmission of user-supplied images or prompts to an external service.
The skill instructs fallback use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at invocation time. That creates a supply-chain risk: behavior can change unexpectedly, and a compromised or malicious newly-published version could be fetched and executed in the agent environment.
This finding duplicates the same persistence behavior at the same location: unpacking software into a user-controlled directory and exporting a modified PATH, with optional persistence via shell config changes. Persistent environment alteration is risky in agent contexts because it outlives the immediate task and can influence later executions in hard-to-audit ways.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This finding duplicates the same persistence behavior at the same location: unpacking software into a user-controlled directory and exporting a modified PATH, with optional persistence via shell config changes. Persistent environment alteration is risky in agent contexts because it outlives the immediate task and can influence later executions in hard-to-audit ways.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions specify that the CLI message is already user-facing Chinese and should be relayed as-is, and the overall guidance is written to assume Chinese-language interaction. This can violate language/locale policy when the user has not opted into Chinese or may prefer another language.