Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Qinghu/qhkit workflow for e-commerce model and face replacement, with some normal install and privacy cautions but no artifact-backed malicious behavior.
Before installing, be comfortable creating or using a Qinghu account, storing a qhkit token, uploading the relevant media to Qinghu's service, and allowing npm/qhkit setup on the machine. For real people, only use it when you have permission to use their likeness; for tighter supply-chain control, install a reviewed/pinned qhkit version manually instead of relying on latest or npx.
The manifest description says the skill must trigger when the user asks to '换模特、换脸、模特本地化' and also includes generic terms like '换人' and '人物替换'. These phrases are broad enough to overlap with ordinary image-editing requests and the file does not provide exclusion conditions or negative examples to bound when invocation should not occur.
The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact version. That makes behavior non-deterministic and can pull whatever package version is current at execution time, increasing supply-chain risk if a bad release or compromised dependency is published. In this context, the skill also encourages on-demand installation and execution, which makes the risk more actionable.
This is a duplicate report of the same persistent-install behavior: extracting Node.js into $HOME/.local/lib and exporting a modified PATH. Such persistence can affect later sessions and commands, creating an unnecessary foothold for future misuse or accidental dependency shadowing. In a skill that already promotes automatic bootstrap, persistent state makes the behavior more dangerous than a one-off local command.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This is a duplicate report of the same persistent-install behavior: extracting Node.js into $HOME/.local/lib and exporting a modified PATH. Such persistence can affect later sessions and commands, creating an unnecessary foothold for future misuse or accidental dependency shadowing. In a skill that already promotes automatic bootstrap, persistent state makes the behavior more dangerous than a one-off local command.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions state the skill must use the domestic iqinghu.com site and explicitly tell the agent not to guide users with the international site unless the user clearly says they use that account. This imposes a locale-specific path by default rather than offering a language/region choice or opt-in, which is a natural-language locale policy concern.