电商爆款主图复刻 | 主图模仿 | 高点击主图 | 竞品图复刻 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:23 AM UTC
• Version: 0.1.0

Overview

The skill matches its stated image-generation purpose, but it asks the agent to install and update an unpinned third-party global CLI and handle an API token, which needs user review before use.

Install only if you trust the Qinghu service and the @iqinghu/qhkit npm package. Prefer a local or pinned install where possible, avoid pasting production tokens into commands that may be logged, use a limited or revocable token, and review which images will be uploaded before running generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38
• Finding: Mutable Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38–65 **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit execution through: ```bash npx @iqinghu/qhkit <command> ... ``` ### Technical Analysis The Skill requires installation and execution of the external npm package `@iqinghu/qhkit`, but its implementation is not included in the reviewed project. Consequently, the behavior of the executable package—including npm lifecycle scripts—cannot be verified from the Skill contents. The upgrade instruction explicitly selects the mutable `latest` release. The instructions also permit package retrieval through an alternative registry. Neither approach pins the dependency to a reviewed version and integrity value. Global installation is broader than necessary because the declared image-generation functionality can be implemented with a project-local, isolated dependency. This creates a supply-chain execution boundary: control of the package publisher account, a package release, or a configured registry could permit attacker-controlled JavaScript or lifecycle scripts to execute during installation or later CLI invocation. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, release process, or permitted package mirror. 2. The attacker publishes a malicious release under the legitimate package name or causes the mutable `latest` tag to resolve to a compromised release. 3. A user or Agent follows the Skill instructions and runs the global installation, automatic upgrade, or `npx` command. 4. npm downloads the compromised package and may run its lifecycle scripts during installation. 5. The installed `qhkit` executable subsequently runs with the privileges and environment of the invoking user. 6. The malicious package can access files, e ...[truncated 728 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using `@latest`. 2. Record and verify the package integrity hash through a lockfile or equivalent trusted manifest. 3. Prefer a project-local installation over `npm i -g` to reduce installation scope and prevent modification of global tool state. 4. Execute the dependency in a restricted environment with access only to the required image files and API endpoint. 5. Avoid automatic upgrades based solely on remote CLI messages; require an explicit review and approval step. 6. Use one explicitly trusted registry and document its trust assumptions. Do not silently switch registries. 7. Where compatible with the package, disable npm lifecycle scripts during installation and separately review any required scripts before execution. 8. Run installation and CLI operations without administrator or root privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 56 **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <secret> --env prod ``` The source instruction requires the user to replace the placeholder with the actual Qinghu API token. ### Technical Analysis The documented configuration method places the API token directly in a command-line argument. Depending on the operating system and execution environment, command-line arguments can be exposed through: - Shell history files - Process listings and process-inspection interfaces - Terminal capture and session recording - Agent command transcripts - Debugging, telemetry, or audit logs - Error reports that reproduce the invoked command Although the Skill alternatively mentions the `QHKIT_TOKEN` environment variable, environment variables can also leak through child processes or diagnostic output. Neither documented method establishes protected interactive input, ephemeral secret injection, or secure storage permissions. ### Attack Path 1. The user substitutes a real production API token into the documented command. 2. The shell records the command in history, or the Agent/runtime records it in execution logs or transcripts. 3. Alternatively, another local process or user inspects the command line while `qhkit` is running. 4. An unauthorized party obtains the token from the exposed command, history, process metadata, or logs. 5. The party authenticates to the Qinghu service using the stolen token. 6. The party invokes available API operations and consumes the victim's credits within the token's authorized scope. ### Impact Assessment Exploitation does not directly grant operating-system privileges. It grants the service permissions associated with the exposed token. Likely consequences include unauthorized image-generation requests, credit consumption, access to token-associated service capabilities, and possib ...[truncated 166 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the command-line token argument with an interactive hidden prompt or standard-input mechanism that does not echo or persist the secret. 2. If environment-based injection is required, set the variable only for the individual process and avoid writing it to shell startup files. 3. Ensure Agent transcripts, command logs, telemetry, and error reports redact token values. 4. Store persistent credentials only in a platform credential manager or a configuration file with owner-only permissions. 5. Document token rotation and immediate revocation procedures for suspected disclosure. 6. Use narrowly scoped, short-lived tokens where supported. 7. Explicitly warn users not to paste production tokens into commands that may be retained in shell history. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation rule is mandatory and lacks clear boundaries for when not to invoke the skill, making it prone to overmatching. In an agent setting, this can override more appropriate skills or normal conversation flow and lead to unnecessary package installation, credential prompting, and external service usage.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation rule is mandatory and lacks clear boundaries for when not to invoke the skill, making it prone to overmatching. In an agent setting, this can override more appropriate skills or normal conversation flow and lead to unnecessary package installation, credential prompting, and external service usage.

Static analysis

No suspicious patterns detected.