电商印花贴合 | 智能贴合 | 服装印花合成 | 商品效果图 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:24 AM UTC
• Version: 0.1.0

Overview

This skill does a coherent product-mockup job, but its setup and upgrade instructions can change the local environment and may execute upgrade commands from remote output.

Install only if you are comfortable with qhkit receiving the images and prompts used for mockups. Before use, require approval for package installs, upgrades, Node installation, mirror use, and token setup; prefer an environment variable or secret manager for the token, and do not execute upgrade commands copied from remote response messages without manual review.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42
• Finding: Unpinned npm Package Is Installed and Executed Globally## Vulnerability Details **File Location**: `SKILL.md`, lines 42 and 65 **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The upgrade procedure also installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the agent to globally install and execute an npm package without pinning it to a reviewed version or verifying package integrity. Both the versionless installation and the explicit `@latest` installation resolve to mutable package content at execution time. npm installation can execute package lifecycle scripts. Consequently, a compromised package release, maintainer account, npm registry response, or configured mirror could introduce code that was not present when this Skill was audited. Global installation also exposes the package executable across the user's environment rather than isolating it to the current task. The fallback mirror described by the Skill creates an additional supply-chain trust relationship. There is no evidence in the audited file that the package or mirror is malicious, but the installation process does not provide sufficient reproducibility or integrity enforcement. ### Attack Path 1. An attacker compromises the npm package, a package maintainer account, the registry distribution channel, or a configured mirror. 2. The attacker publishes a malicious release as the current default or latest version. 3. The agent follows the Skill and runs the unpinned global installation command. 4. Malicious lifecycle code executes during installation, or malicious behavior runs when the installed `qhkit` command is invoked. 5. The payload gains the permissions of the account performing the installation. ### Impact Assessment Successful exploitation can execute arbitrary code with the installing user's privileges. This may permit access t ...[truncated 341 chars]
• Remediation: ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using a versionless package reference or `@latest`. - Record and verify the expected package integrity value or use a lockfile with integrity metadata. - Install the dependency in a task-specific, non-global directory to limit executable replacement and environmental impact. - Disable npm lifecycle scripts with `--ignore-scripts` when the package can operate without them. - Require explicit user approval before installing or upgrading executable dependencies. - Review a new package version before updating the pinned version. - Prefer the official registry and apply equivalent integrity checks when a mirror must be used.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Remote Service Responses May Supply Shell Commands for Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 62-65 **Vulnerability Type**: Remote command retrieval and execution **Risk Level**: High ### Code Snippet The source instruction states, translated into English: ```text If the command returns a version-stage response, the message contains the upgrade command; execute it as instructed. ``` It then presents the expected local upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill tells the agent to treat the `message` field of a remote CLI or service response as an executable upgrade instruction. The response is external data and is not constrained by a locally defined allowlist or strict parser. If the service endpoint, account, package, or response path is compromised, an attacker could replace the expected upgrade advice with an arbitrary shell command. Following the instruction literally would cross the trust boundary between remote data and local code execution. This behavior is not necessary for image generation: upgrade status may be reported remotely, but the permitted remediation command should be defined and validated locally. ### Attack Path 1. An attacker gains control over the service response, compromises the remote service, or compromises the locally installed CLI that formats the response. 2. A command returns a response with `stage` set to `version`. 3. The attacker places a malicious shell command in the response's `message` field and represents it as an upgrade command. 4. The agent follows the Skill's instruction to execute the command as provided. 5. The command runs locally with the agent process's current permissions. ### Impact Assessment Exploitation could result in arbitrary command execution under the agent's operating-system account. The attacker could read or modify user-accessible files, obtain environment variables and locally stored API credentials, upload data, install addit ...[truncated 252 chars]
• Remediation: ## Remediation Suggestions - Never execute shell commands obtained from a remote response field. - Treat the response message as display-only, untrusted text. - Define the complete set of permitted upgrade commands locally. - If `stage` is `version`, offer only a fixed, pinned installation command after explicit user confirmation. - Validate the executable name, package name, version, registry, and arguments against a strict allowlist. - Avoid invoking a general-purpose shell for upgrade handling. - Log the service response separately from any locally selected remediation action.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: API Token Is Passed Through a Command-Line Argument## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Code Snippet ```bash qhkit config set --token <API_TOKEN> --env prod ``` ### Technical Analysis The documented configuration method places the API token directly in a command-line argument. Depending on the operating system, shell, execution framework, and logging configuration, command arguments may be visible through process inspection, shell history, audit logs, terminal capture, error telemetry, or agent transcripts. Although the Skill also mentions the `QHKIT_TOKEN` environment variable, it presents the command-line method as a normal configuration path and does not require history suppression, redaction, protected input, or validation of the resulting configuration file's permissions. ### Attack Path 1. A user supplies an API token to configure `qhkit`. 2. The agent substitutes the token into the documented command. 3. The command or its arguments are retained in shell history, execution logs, telemetry, or a transcript, or are observed through process inspection while it runs. 4. A local user, log reader, or other party with access to those records obtains the token. 5. The exposed token is reused to access the remote service and consume resources associated with the user's account. ### Impact Assessment Exposure may enable unauthorized API requests, consumption of account credits, access to functionality available to the token, and attribution of attacker activity to the victim's account. The precise remote scope depends on permissions assigned to the token. This issue does not itself grant operating-system privilege escalation.
• Remediation: ## Remediation Suggestions - Prefer a protected environment variable or a standard secret manager instead of a command-line argument. - Where supported, accept the token through standard input or an interactive hidden prompt. - Prevent commands containing credentials from being written to shell history or agent execution logs. - Redact token values from transcripts, telemetry, errors, and diagnostic output. - Store persistent credentials only in a file with restrictive user-only permissions. - Document token rotation and revocation procedures in case accidental disclosure occurs. - Ensure `qhkit config show` never prints the full credential.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill declares that it 'must' trigger for broad, common image-editing requests such as applying a design to a product or making a mockup, without meaningful exclusions or user-confirmation requirements. This can cause the agent to invoke an external tool too aggressively, sending user assets or prompts to a third-party service when a safer or local response path might have been appropriate.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to modify the host environment by installing packages globally, downloading and extracting Node.js binaries, changing PATH, and using alternate package mirrors, all framed as 'don't give up' environment bootstrapping. In an agent context, these are sensitive system-changing operations that may occur without explicit user approval, increasing the risk of unwanted software installation, supply-chain exposure, and persistence changes on the machine.

Static analysis

No suspicious patterns detected.