Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent virtual try-on workflow, but users should notice that it installs and configures an external CLI and sends provided images to a paid Qinghu AI service.
Install only if you are comfortable using the Qinghu qhkit CLI, providing a Qinghu API token, and uploading the model and clothing images to that service. Confirm credit estimates before generation, avoid using unauthorized likenesses or garments, and approve any npm, Node, or shell profile changes before the agent performs them.
The description says the skill 'must trigger' for broad, everyday clothing-editing requests. Mandatory activation language with wide trigger phrases can cause over-invocation, steering the agent into external tool usage and paid or sensitive operations even when the user did not explicitly ask to use this skill.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact package version, which makes execution depend on whatever version is current at runtime. That creates a supply-chain risk: a malicious or compromised future release could be fetched and executed automatically, especially because the package is presented as a fallback path when global install fails.
This duplicate finding points to the same persistence behavior: unpacking software into a user-owned directory and exporting a new PATH, with guidance to make it survive across commands. In a skill, such self-bootstrap behavior increases risk because it normalizes host mutation rather than using pre-provisioned or sandboxed dependencies.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking software into a user-owned directory and exporting a new PATH, with guidance to make it survive across commands. In a skill, such self-bootstrap behavior increases risk because it normalizes host mutation rather than using pre-provisioned or sandboxed dependencies.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to relay CLI messages in Chinese and emphasizes Chinese-language handling without user opt-in. Forcing a language can mislead or disadvantage users who expect another language, reduce informed consent around billing/errors, and interfere with safe, clear communication.