Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for generating marketing image variations, but it tells the agent to bootstrap and upgrade unpinned CLI and Node tooling on the host without clear user confirmation.
Install only if you are comfortable letting the agent install or upgrade qhkit/Node tooling and configure a Qinghu token for the CN service. Prefer preinstalling a reviewed, pinned qhkit version yourself and asking the agent not to run global npm, npx, or Node bootstrap commands automatically.
The description says this skill 'must trigger' for broad classes of user requests, creating an aggressive auto-invocation rule. In context, that can cause the agent to enter a workflow that installs software, requests tokens, or contacts external services even when the user only asked generally about generating variants.
The skill goes far beyond image-generation guidance by instructing the agent to install Node.js, globally install a CLI, and later upgrade it. This materially expands the attack surface and permits persistent modification of the host environment, including fetching and executing remote code from package registries and download mirrors.
The skill recommends falling back to npx @iqinghu/qhkit <命令> without pinning a version, which causes execution of whatever package version is current at invocation time. That introduces a supply-chain risk: behavior can change unexpectedly or a compromised upstream release could execute arbitrary code in the agent environment.
This duplicate finding points to the same persistence behavior: installing Node into a user directory and changing PATH for subsequent shells. Even with checksum verification, it still establishes persistent execution capability beyond the intended image-variation task and widens the blast radius of any upstream compromise or operator mistake.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: installing Node into a user directory and changing PATH for subsequent shells. Even with checksum verification, it still establishes persistent execution capability beyond the intended image-variation task and widens the blast radius of any upstream compromise or operator mistake.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions require the domestic CN site configuration and say to preserve intl only if the user explicitly says they use the international account. This imposes a locale/site choice by default rather than offering the user a language/region option, which conflicts with the requirement not to force a specific locale without user opt-in.
The '何时触发' section provides only a couple of positive examples, including a very general request like '多出几版不同风格的', but does not specify when the skill should not be used. Without exclusions, similar everyday requests could accidentally match this skill instead of a more appropriate image-editing or design tool.