Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Qinghu AI photo-editing workflow, but it can upload images to a paid external service and may install or update local command-line dependencies.
Install only if you are comfortable sending the selected portrait/model image to Qinghu's service, using Qinghu credits, and allowing qhkit or Node setup on the machine. Prefer reviewing dependency installation commands and confirming the estimate before any paid generation.
The trigger description requires invocation on broad natural-language phrases like '模特图太假', '要更真实的质感', or '提亮肤色'. Overbroad mandatory triggers can cause the skill to activate in contexts where the user did not intend external tool use, increasing the chance of unnecessary file handling, third-party API calls, or token-gated actions.
The example trigger list includes ambiguous phrases such as '洗一下这张图' and '提亮肤色' without clear limits to human model-photo workflows. In an agent environment, such phrases are common and could spur unintended invocation on unrelated images or casual discussion, leading to unnecessary external processing and user-confusing side effects.
The skill instructs falling back to npx @iqinghu/qhkit <命令> ... without pinning an exact version. That allows execution of whatever package version is current at runtime, creating supply-chain risk and making behavior non-reproducible; if the package is compromised or a breaking version is published, the agent may execute attacker-controlled code.
The same installation block persists binaries under the user's home directory and recommends PATH persistence across commands. Even though presented as convenience, this changes system state in a durable way and broadens the blast radius of any compromised dependency or later misuse of the installed tool.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The same installation block persists binaries under the user's home directory and recommends PATH persistence across commands. Even though presented as convenience, this changes system state in a durable way and broadens the blast radius of any compromised dependency or later misuse of the installed tool.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"