Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent product-image replacement helper that uses a disclosed external CLI and API, with install and token setup risks users should understand.
Install only if you are comfortable using the Qinghu qhkit CLI, sending referenced images to that service, and configuring a qhkit API token. Prefer a managed or pinned install where available, and avoid adding PATH changes to shell startup files unless you want the Node fallback to persist across sessions.
The description says the skill '必须触发' whenever a user asks to replace a product in an image, reuse a scene for a new product, or replace the product subject, and then lists broad keyword-style triggers. This creates an ambiguous activation boundary because it does not provide exclusions or negative examples, so related everyday editing requests could unintentionally match.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed automatically in the agent environment.
This duplicate finding points to the same behavior: unpacking Node into a user-controlled directory and altering PATH, with optional persistence via shell profile changes. Even though checksum verification is present, the concern is the durable environment modification itself, which is risky in agent systems because it creates lasting state and an avenue for later unintended execution.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same behavior: unpacking Node into a user-controlled directory and altering PATH, with optional persistence via shell profile changes. Even though checksum verification is present, the concern is the durable environment modification itself, which is risky in agent systems because it creates lasting state and an avenue for later unintended execution.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The file instructs the agent to relay the CLI message because it is already '面向用户的中文', which implies a fixed Chinese-language response behavior. This is a language policy issue because the skill does not offer language choice or require checking the user's preferred language first.
The '何时触发' section gives only two positive examples and no negative examples or constraints, while the skill sits near adjacent tasks like background replacement or face/model replacement. Without clearer scope boundaries in the trigger section, similar user requests could be routed here incorrectly.