Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed e-commerce image-generation integration, with ordinary but notable dependency, upload, and credential setup risks.
Install this only if you are comfortable sending product images and prompt text to the iqinghu service, storing or providing a QHKIT token, and installing npm-based tooling on the machine. For tighter control, prefer a preinstalled or version-pinned qhkit package and avoid adding Node PATH changes to shell startup files unless needed.
The top-level description says the skill 'must' trigger for a broad set of common image requests such as making main images, carousel images, or 'a set of images' from a product picture. Overly broad mandatory triggering can cause the agent to invoke this external tool in situations where the user's intent is ambiguous, increasing unnecessary data exposure and unintended third-party actions.
The invocation examples include broad natural-language phrases like '出一组商品图' and requests for multiple styles/platforms, which are common enough to match ordinary conversation beyond the intended narrow workflow. In skill-routing systems, such ambiguity can cause over-invocation of a tool that uploads local images and calls an external service.
The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact version. That allows whatever version is current at invocation time to be fetched and executed, creating supply-chain risk and reducing reproducibility if a compromised or breaking release is published.
The skill directs installation of Node into $HOME/.local/lib and modification of PATH, which persists executable tooling in the user environment beyond the current task. Even though this is framed as bootstrapping, it changes the session environment and leaves software behind, increasing attack surface and enabling later unintended execution of downloaded binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs installation of Node into $HOME/.local/lib and modification of PATH, which persists executable tooling in the user environment beyond the current task. Even though this is framed as bootstrapping, it changes the session environment and leaves software behind, increasing attack surface and enabling later unintended execution of downloaded binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"