AI视频处理工具、图像处理工具 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:24 AM UTC
• Version: 0.1.0

Overview

This media-processing skill is coherent, but it asks agents to install mutable third-party CLI code and can upload local media to an external service without a clear per-upload consent step.

Review this skill before installing. Use it only for media you are allowed to upload to Qinghu/qhkit services, avoid confidential or regulated files unless you have checked the provider's handling terms, and prefer a pinned or locally reviewed qhkit version instead of automatic latest or npx execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44
• Finding: Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 44–50; additional upgrade instruction at lines 71–75 **Vulnerability Type**: Untrusted and mutable third-party dependency execution **Risk Level**: Medium ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also allow execution through `npx @iqinghu/qhkit` and later recommend installing `@iqinghu/qhkit@latest`. ### Technical Analysis The Skill instructs the Agent to install and execute a third-party npm package whose implementation is not included in the audited artifact. The requested package version is not pinned, and the upgrade procedure explicitly selects the mutable `latest` release. Consequently, the code executed during one invocation may differ from the code available when the Skill was reviewed. Global npm installation can execute package lifecycle scripts and installs executable commands into the user's global npm environment. The documented `npx` fallback can also download and immediately execute the package. Use of the alternate `registry.npmmirror.com` registry increases the number of supply-chain systems that must be trusted. This behavior supports the declared media-processing functionality, but automatic installation and execution of mutable third-party code exceed the minimum risk necessary when compared with a pinned, integrity-verified dependency. ### Attack Path 1. An attacker compromises the npm package, a package maintainer account, a registry, or a newly published package release. 2. The compromised release is assigned the selected version or the `latest` tag. 3. The Agent follows the Skill instructions and runs the global npm installation, upgrade, or `npx` fallback. 4. npm lifecycle scripts or the installed CLI execute attacker-controlled code locally. 5. The malicious code operates with the privileges of the user running the Agent and may access files, environment variables, network resources, and credentials available t ...[truncated 482 chars]
• Remediation: ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specifically reviewed version instead of using an implicit current version or `@latest`. - Verify package integrity using a lockfile, npm integrity metadata, or a separately authenticated checksum. - Remove automatic upgrade instructions and require explicit user approval before changing the installed version. - Avoid `npx` download-and-execute behavior unless the exact version and integrity are specified. - Prefer a project-local installation in an isolated environment rather than modifying the user's global npm environment. - Disable npm lifecycle scripts where compatible with the package and verify that the CLI still functions correctly. - Require explicit confirmation before installation and disclose that third-party code will execute with the user's privileges. - Vet each permitted registry and avoid silently switching dependency sources.

other

Warning

• Location: SKILL.md:23
• Finding: Local Media Is Automatically Uploaded to an External Processing Service## Vulnerability Details **File Location**: `SKILL.md`, lines 23–27; behavior reiterated at lines 77–79 **Vulnerability Type**: External transmission of local user files without a mandatory confirmation step **Risk Level**: Medium ```bash qhkit video-edit generate '{"action":"remove_watermark","urls":["./video.mp4"]}' qhkit video-edit generate '{"action":"remove_subtitle","urls":["./video.mp4"]}' qhkit video-edit generate '{"action":"video_super_resolve","urls":["./video.mp4"],"resolution":"4k","fps":60}' ``` The accompanying instructions state that local file paths are accepted and that the CLI automatically uploads those files to obtain externally accessible URLs. ### Technical Analysis The examples pass local media paths to `qhkit`, while the Skill contract explains that the CLI automatically uploads local files to an external provider. External processing is relevant to the declared cloud-based media functionality, but the Skill does not require the Agent to obtain informed user approval immediately before transmission. The instructions do not define destination boundaries, retention periods, deletion procedures, encryption assurances, regional processing constraints, or restrictions for confidential and regulated data. The external CLI and server implementation are absent from the project, so the audit cannot verify what metadata is collected, where files are stored, or whether files are deleted after processing. ### Attack Path 1. A user provides or references a local image or video for editing. 2. The Agent follows the Skill recipe and supplies the local path to `qhkit`. 3. The CLI reads the local file and automatically uploads it to the external service. 4. The provider receives and processes the media without a mandatory per-upload confirmation in the Skill workflow. 5. If the media is confidential, personal, copyrighted, or regulated, this transmission may constitute unintended disclosure or violate applicable ...[truncated 502 chars]
• Remediation: ## Remediation Suggestions - Require explicit, informed user confirmation before uploading each local file or batch. - Clearly identify the receiving service and link to its privacy, retention, deletion, and regional processing policies. - Display the exact files selected for transmission and prevent directory-wide or unintended uploads. - Warn users not to submit confidential, personal, regulated, or third-party copyrighted media without authorization. - Strip unnecessary metadata before upload where feasible. - Provide a local-only processing option for sensitive content. - Use encrypted transport and document server-side encryption and access controls. - Define retention limits and provide a reliable deletion mechanism for uploaded inputs and generated outputs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill declares that it 'must trigger' for broadly defined image/video processing requests, creating an overbroad routing rule that can force use of this external-tool workflow even when a simpler or safer response would suffice. In this context, the danger is amplified because the skill later instructs the agent to install software, request API tokens, and upload local files or URLs, so an overly broad mandatory trigger can cause unnecessary external exposure and tool execution.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill states that local file paths are automatically uploaded by the CLI and that public URLs may also be sent to the service, but it does not present a prominent user warning or consent requirement before this transfer occurs. This is dangerous because users may believe processing is local while sensitive media, embedded metadata, or proprietary assets are actually transmitted to an external service, creating privacy, confidentiality, and compliance risks.

Static analysis

No suspicious patterns detected.