Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently runs a disclosed paid image-upscaling workflow, with some installation and third-party upload cautions users should understand first.
Install only if you are comfortable sending selected images to Qinghu's service, configuring a qhkit API token, and using paid credits. Prefer a preinstalled or pinned qhkit version where possible, and review any global npm/Node installation before allowing the agent to change your environment.
The description says the skill 'must trigger' for broad categories like blurry images, upscaling, old photo restoration, and print-resolution needs. This can cause unintended automatic invocation, routing user content to an external paid/image-processing service without sufficiently narrow consent or confirmation.
The instructions require using exact Chinese field names and Chinese option names, and elsewhere note that CLI messages are user-facing Chinese. This imposes a specific language/locale behavior without offering a user choice or documenting an opt-in, which can violate language/locale policy expectations.
The skill recommends falling back to npx @iqinghu/qhkit <命令> ... without pinning an exact package version. That causes live retrieval of whatever version is current at execution time, creating a supply-chain risk where a compromised or breaking upstream release could be executed automatically in the user environment.
This duplicate finding points to the same behavior: unpacking binaries into a user-controlled directory and prepending them to PATH. Even though the text includes checksum verification, the persistence and environment mutation remain dangerous in an agent skill because future command resolution may silently change.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same behavior: unpacking binaries into a user-controlled directory and prepending them to PATH. Even though the text includes checksum verification, the persistence and environment mutation remain dangerous in an agent skill because future command resolution may silently change.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"