AI电商模特换装 | AI换装 | 服装试穿 | 换装工具 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:24 AM UTC
• Version: 0.1.0

Overview

The skill matches its advertised outfit-swap purpose, but it asks the agent to install and update mutable command-line software and to run upgrade commands supplied by tool output, which needs review before use.

Install only if you are comfortable with Qinghu/qhkit receiving the images used for generation and with the agent installing or updating local CLI software. Prefer a preinstalled, pinned qhkit version managed by an administrator, avoid executing upgrade commands copied from tool output, and provide the API token through a safer secret mechanism where available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:45
• Finding: Execution of Mutable, Unpinned npm Package Releases<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45-48 and 63-66 **Vulnerability Type**: Supply-chain exposure through unpinned third-party package installation **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit changing the package source to: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning an audited version or package integrity value. The explicit use of `@latest` makes the installed code mutable after the Skill itself has been reviewed. The `npx` fallback can similarly retrieve and immediately execute package content. npm packages may execute lifecycle scripts during installation, and the installed CLI subsequently runs with the permissions of the Agent process. Global installation unnecessarily increases the affected installation scope compared with a local, isolated dependency. Permitting a registry mirror also introduces another supply-chain trust point, even though the documented mirror is presented as a network fallback. This behavior is needed only to obtain the declared image-generation client; global installation and mutable-version execution exceed the minimum necessary privilege and trust scope. ### Attack Path 1. An attacker compromises the package maintainer account, package release process, registry response, or allowed mirror. 2. The attacker publishes malicious content under the expected package name or mutable latest version. 3. The Agent follows the Skill instructions and runs `npm i -g`, `npm i -g ...@latest`, or `npx`. 4. npm retrieves the attacker-controlled release. 5. Malicious lifecycle scripts execute during installation, or malicious code executes when the CLI is invoked. 6. The payload gains access to the Agent process's files, environment variables, network access, ...[truncated 569 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than using an unqualified package or `@latest`. 2. Lock and verify the package integrity hash before installation. 3. Remove the instruction to execute package content through an unpinned `npx` invocation. 4. Install the dependency locally in a dedicated, restricted directory or container rather than globally. 5. Run installation and execution as an unprivileged account with access only to the images required for the current request. 6. Disable npm lifecycle scripts where compatible, for example with `--ignore-scripts`, and separately review any required installation scripts. 7. Require explicit review and approval before changing package versions or registries. 8. Prefer a trusted internal package mirror with provenance verification and allowlisted artifacts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63
• Finding: Blind Execution of Upgrade Commands Supplied Through CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Command injection through trusted runtime output **Risk Level**: High ### Vulnerable Instruction The operative instruction, translated into English, is: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it exactly as provided. ``` ### Technical Analysis The Skill directs the Agent to treat a runtime-controlled `message` field as an executable command. The message may originate from the installed CLI or data received by that CLI from its backend. It is not constrained to an allowlisted command, parsed as structured version metadata, or independently validated before execution. Error messages and remote service responses must be treated as untrusted data. Converting them directly into shell instructions creates a command-injection boundary. This is especially dangerous because the same Skill installs a mutable third-party CLI whose behavior and output can change independently of the reviewed Skill file. Executing arbitrary returned command text is not necessary for the declared image-generation functionality and exceeds least privilege. A fixed, locally defined update procedure would provide the needed behavior without granting command authority to runtime output. ### Attack Path 1. An attacker compromises the `qhkit` package, its update mechanism, or a backend response used to construct the version error. 2. The attacker causes the CLI to return a version-stage error containing a malicious shell command in `message`. 3. The Agent follows the Skill directive to execute the command exactly as returned. 4. The shell interprets attacker-controlled operators, arguments, substitutions, or redirections. 5. The injected payload executes with the Agent's current operating-system privileges. An example payload class would be a purported upgrade command that appends additional shell operations using co ...[truncated 637 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the directive to execute commands contained in `message`, stderr, or any other runtime output. 2. Treat returned messages as display-only untrusted text. 3. Map a structured version error to a fixed local action, such as an allowlisted package command with an exact pinned version. 4. Validate the requested version against a strict semantic-version parser and an approved release list. 5. Present the proposed update and package version to the user for explicit approval before installation. 6. Invoke package-management operations with an argument array rather than constructing a shell command from strings. 7. Run updates in a sandbox under an unprivileged account and verify package provenance and integrity. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Sensitive credential exposure in process arguments and command history **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <API_TOKEN> --env prod ``` The Skill alternatively permits the credential to be supplied through: ```bash QHKIT_TOKEN ``` ### Technical Analysis Passing an API token directly as a command-line argument may expose it outside the intended process. Depending on the operating system, shell, Agent framework, and logging configuration, command arguments may be recorded in shell history, process listings, telemetry, audit logs, error reports, or conversation transcripts. The environment-variable alternative avoids shell-history exposure but may still leak through inherited environments, process diagnostics, crash reports, or child processes. The Skill does not document protected standard-input handling, secret-store integration, redaction requirements, or restrictive permissions for the resulting configuration file. The credential is legitimate and required to use the declared cloud service. However, placing it directly on the command line is not the minimum-exposure method. ### Attack Path 1. A user supplies the Qinghu API token as directed. 2. The Agent constructs and executes a command containing the token in its argument list. 3. The complete command is retained in shell history, Agent logs, process telemetry, or another process-observation mechanism. 4. A local user, log reader, support operator, or compromised process retrieves the token. 5. The attacker uses the token to authenticate to the Qinghu service and consume resources available to the associated account. ### Impact Assessment The primary impact is unauthorized access to the capabilities and quota associated with the exposed Qinghu API token. This may include unauthorized image-generation requests, credit consumption, and access to any account-scoped A ...[truncated 127 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a token-input mode that reads the secret from protected standard input without echoing it. 2. Prefer an operating-system credential store or dedicated secret manager. 3. If an environment variable must be used, scope it only to the individual process and prevent unnecessary inheritance. 4. Never print the token in stdout, stderr, diagnostic output, or Agent responses. 5. Disable command tracing and command-history recording while handling credentials. 6. Store any local configuration containing the token with owner-only permissions. 7. Document token rotation and immediate revocation procedures for suspected exposure. 8. Use narrowly scoped, short-lived tokens where the service supports them. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to bootstrap missing dependencies by installing npm packages and even downloading and unpacking Node.js binaries. For an image outfit-swap skill, this expands behavior from using an expected local tool into performing software installation and network retrieval, which increases supply-chain and environment-modification risk beyond the minimum required capability.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The metadata says outfit-swap requests 'must trigger' on a broad set of common clothing-image phrases, which can cause the agent to invoke this skill in cases where the user did not clearly request third-party processing or image generation. Overbroad mandatory triggering is dangerous because it can misroute benign requests, cause unintended external API use, and expose user images or prompts to the tool without sufficiently precise user intent.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The trigger examples only show positive matches and provide no negative examples or exclusions, leaving the activation boundary unclear. In practice this increases accidental invocation risk, especially for adjacent tasks like simple image editing, color changes, face swaps, or general fashion advice that should not automatically send data to the outfit-swap tool.

Static analysis

No suspicious patterns detected.