AI生成电商营销素材 | 千川投流素材 | 直通车图 | 节日活动图 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:23 AM UTC
• Version: 0.1.0

Overview

This skill is purpose-aligned for generating marketing assets, but it asks agents to install and upgrade an unpinned global CLI and to follow upgrade commands from tool output.

Review this skill before installing. Use it only if you are comfortable with Qinghu/qhkit receiving product assets and using a QHKIT token, prefer a sandbox or project-local pinned install, and do not let an agent execute upgrade commands copied from CLI output without separate human verification.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:47`, `SKILL.md:50`, and `SKILL.md:68` **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit npx @iqinghu/qhkit <command> ... npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to install or execute `@iqinghu/qhkit` without pinning it to a reviewed version or integrity digest. The `@latest` upgrade explicitly selects whichever release the registry currently designates as latest. An unversioned `npx` invocation can likewise download and immediately execute a release that was not present when the Skill was audited. The global installation also creates a broader system-level modification than a project-local or isolated installation. Although the instructions do not request root access, the package and its npm lifecycle scripts execute with all permissions held by the Agent user. This is a supply-chain exposure rather than evidence that the current package is malicious. Exploitation requires compromise of the package publisher, registry resolution path, distribution mirror, or a future package release. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or a future release of `@iqinghu/qhkit`. 2. The attacker publishes a malicious release and causes it to be selected by an unversioned installation, `@latest`, or `npx`. 3. The Agent follows the Skill instructions and downloads the malicious package. 4. npm lifecycle scripts or the CLI entry point execute under the Agent user's identity. 5. The malicious code accesses files, environment variables, configured API credentials, and network resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the Agent user. This could expose the `QHKIT_TOKE ...[truncated 413 chars]
• Remediation: ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specifically audited version instead of using an unversioned package or `@latest`. - Record and verify the expected npm integrity digest through a lockfile or equivalent trusted manifest. - Prefer a project-local, isolated installation rather than `npm i -g`. - Avoid automatic `npx` downloads. Configure `npx` to use an already installed, verified package. - Disable npm lifecycle scripts during installation where compatible with the package. - Require explicit user approval before installing or upgrading executable dependencies. - Review release provenance and package signatures before accepting an upgrade. - Run the CLI in a sandbox with access limited to the specific media files required for the task and only the necessary credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65
• Finding: Unvalidated Execution of an Upgrade Command Supplied Through CLI Output## Vulnerability Details **File Location**: `SKILL.md:65` **Vulnerability Type**: Untrusted command execution through dynamically supplied CLI output **Risk Level**: Medium ### Vulnerable Instruction ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as instructed. ``` ### Technical Analysis The Skill instructs the Agent to treat the CLI's `message` field as an executable upgrade command. No command allowlist, argument validation, package-name validation, version validation, or user confirmation is required. CLI output must be treated as untrusted data because it may be generated by the installed package or derived from a remote backend response. If either component is compromised, the returned message can contain shell syntax unrelated to a legitimate upgrade. The nearby fixed upgrade command does not eliminate the vulnerability because the instruction explicitly permits executing the dynamically returned command rather than requiring the Agent to use only the fixed command. ### Attack Path 1. An attacker compromises the installed `qhkit` package, its update-response backend, or another component capable of controlling its version-error message. 2. The compromised component returns `stage:"version"` with a malicious shell command in the `message` field. 3. The Agent follows the Skill instruction to execute the command exactly as supplied. 4. The command executes in the local shell with the Agent user's permissions. 5. The attacker can then read or modify accessible files, extract credentials, download additional payloads, or alter user-level configuration. ### Impact Assessment Exploitation could result in arbitrary command execution under the Agent user's account. Accessible scope may include local media, environment variables, API tokens, user configuration, writable executables, and network-accessible services. No instruction explicitly req ...[truncated 150 chars]
• Remediation: ## Remediation Suggestions - Never execute commands extracted from a CLI response, error message, standard output, or standard error. - Treat the returned version as data and validate it against a strict semantic-version pattern. - Construct the upgrade command locally from a fixed allowlist containing only the expected package and approved arguments. - Pin upgrades to an explicitly reviewed version rather than using `@latest`. - Reject shell metacharacters, additional package names, URLs, redirections, and command substitutions. - Display the proposed version and request explicit user confirmation before upgrading. - Execute installation in a restricted environment with minimal filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill description explicitly states that it 'must trigger' for broad classes of common marketing-related requests, which can cause the agent to invoke this skill even when the user did not specifically ask to use it or when a narrower, safer, or more appropriate skill would suffice. Because the skill also contains installation and environment-bootstrapping instructions, over-triggering increases the chance of unnecessary package installation, credential prompts, and execution of external tooling.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The 'when to trigger' section provides only positive examples and lacks clear boundaries for when the skill should not run. In an agentic environment, ambiguous activation criteria can lead to inappropriate routing of general marketing or creative requests into a skill that may install software, request API tokens, and perform external operations unnecessarily.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The description is written to enforce Chinese-language behavior and keywords without any indication that the user's language preference should control the interaction. Forcing a language can degrade user comprehension, obscure consent around installation/configuration steps, and increase the risk that users approve actions they do not fully understand.

Static analysis

No suspicious patterns detected.