模特换装高一致性 | 换装还原 | 姿态保持 | 细节还原 | LinkPix

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:23 AM UTC
• Version: 0.1.5

Overview

This skill appears to do the advertised virtual try-on workflow, but it asks agents to install and run a mutable third-party CLI and handle user images and service tokens with limited safeguards.

Review before installing. Use this only when you intend to upload authorized model and clothing images to Qinghu for paid processing. Prefer a pinned, local qhkit install where possible, avoid putting API tokens directly in shell commands, and confirm cost and upload intent before running generate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79
• Finding: Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 79–82 and 98–100 **Vulnerability Type**: Supply-chain exposure through mutable npm dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also permit on-demand execution: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly installs the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning an exact, audited version or enforcing package integrity through a lockfile. Both the unversioned package reference and `@latest` are mutable: their effective executable content can change after this Skill has been reviewed. The `npx` fallback can similarly retrieve and immediately run package code. A global npm installation increases the affected scope compared with a local, isolated installation and may run package lifecycle scripts during installation. This behavior is necessary only to the extent that the declared workflow requires the `qhkit` client. Automatic acquisition of an unpinned release, global installation, and unsolicited upgrades exceed the minimum-risk approach needed to provide that functionality. ### Attack Path 1. An attacker compromises the package publisher account, npm release process, registry path, or documented mirror. 2. The attacker publishes a malicious release under the legitimate package name. 3. An Agent follows the Skill and runs the unversioned, `@latest`, or `npx` command. 4. npm downloads the attacker-controlled release. 5. Installation lifecycle scripts or the invoked CLI execute with the Agent user's permissions. 6. Malicious code can access data and credentials available to that user and alter user-writable files. ### Impact Assessment Successful exploitation permits arbitrary code execution ...[truncated 499 chars]
• Remediation: ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a reviewed exact version rather than using an unversioned package reference or `@latest`. - Provide and enforce a lockfile containing npm integrity metadata. - Verify the package version and integrity before execution. - Prefer an isolated, project-local installation over global installation. - Avoid `npx` execution that implicitly downloads a mutable release. If `npx` is unavoidable, specify the exact reviewed version and disable interactive substitution. - Require informed user approval before installing or upgrading executable dependencies. - Perform upgrades only after reviewing the new version and its provenance. - Prefer the official npm registry; treat the fallback mirror as a separate trust dependency and apply equivalent integrity validation.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94
• Finding: API Token Exposed Through a Command-Line Argument## Vulnerability Details **File Location**: `SKILL.md`, line 94 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <secret> --env prod ``` The same instruction offers environment- or file-based alternatives: ```text Alternatively, set the QHKIT_TOKEN environment variable, or use OPENCLAW_CONFIG_PATH to reference an existing configuration file. ``` ### Technical Analysis Passing an API token directly as a command-line argument may expose it outside the intended CLI process. Depending on the shell and operating environment, the secret can be retained in shell history, Agent execution transcripts, terminal logs, audit telemetry, or process argument listings. The token is legitimate and necessary for authenticated use of the declared service, but placing it in the command line is not necessary. Protected standard input, an interactive hidden prompt, or a securely permissioned configuration mechanism would reduce disclosure risk. ### Attack Path 1. A user substitutes a real Qinghu API token into the documented command. 2. The Agent or shell executes the command with the token present in its argument vector. 3. The command is recorded in shell history, execution logs, transcripts, telemetry, or temporarily exposed through process inspection. 4. Another local user, log reader, support operator, or compromised process retrieves the token. 5. The attacker reuses the credential against the Qinghu service. ### Impact Assessment Exposure may allow unauthorized use of the victim's Qinghu account and consumption of paid credits. The attacker may gain whatever service-level access the token grants, potentially including access to account-associated workflow operations. This finding does not establish operating-system privilege escalation. The scope is primarily the external service account, ...[truncated 70 chars]
• Remediation: ## Remediation Suggestions - Remove the command-line token example. - Prefer a hidden interactive prompt or protected standard input so the token is not placed in the process argument vector. - If configuration files are used, require restrictive file permissions and avoid storing the token in project directories. - If an environment variable is used, set it through a protected secret-management mechanism rather than recording an export command in shell history. - Ensure the CLI, Agent, and supporting telemetry redact tokens from stdout, stderr, exception messages, and transcripts. - Document token rotation and revocation procedures for suspected disclosure. - Use narrowly scoped, short-lived credentials if the service supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill metadata and description mandate triggering on broad, common phrases related to changing clothes or making outfit images, which can cause the agent to invoke this external paid/image-processing workflow too aggressively. In context, this increases the chance of unintended data transfer, unnecessary tool use, and misrouting benign conversations into a third-party service handling user images.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs the agent to pass local file paths or remote URLs for model and clothing images to the qhkit CLI, but does not provide a clear upfront privacy/data-transfer warning at the point of collection or invocation. Because the workflow uploads user media to an external service, users may unknowingly expose sensitive personal images, copyrighted assets, or internal URLs.

Static analysis

No suspicious patterns detected.