电商促销海报 | 营销海报 | 大促海报 | 活动图生成 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:24 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent promo-poster generator, but it asks the agent to install and auto-upgrade an unpinned global CLI and handle an API token in a way users should review first.

Review this before installing. It is not evidence of malware, but installation runs a third-party npm CLI globally and may later upgrade it to the latest release automatically. Use a pinned or local install if possible, avoid putting the API token directly in command history or chat logs, and only provide product images or prompts you are comfortable sending to the Qinghu/qhkit service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6
• Finding: Unpinned Third-Party CLI Installation and Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:43-47`, and `SKILL.md:62-66` **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🎉","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The surrounding instructions also permit installation through an alternative npm mirror and execution through an unpinned `npx @iqinghu/qhkit` command. ### Technical Analysis The Skill installs an executable npm package without pinning it to a specific reviewed version or integrity digest. It also directs the Agent to install `@latest` when an upgrade signal is observed. Consequently, the code executed during future Skill invocations is not necessarily the code that existed when the Skill was audited. npm packages may execute code through lifecycle scripts during installation and through the installed CLI when invoked. A malicious or compromised release could therefore run arbitrary commands under the identity of the Agent process. The global installation scope is broader than necessary for a single Skill and can affect other sessions that use the same environment. The permitted mirror fallback increases the number of supply-chain services that must remain trustworthy. If both a package and its metadata are obtained from the same compromised source, normal package-manager checks do not establish that the package matches a separately reviewed release. The Node bootstrap checksum pipeline at `SKILL.md:52-53` is not a `curl | bash` execution pipeline: the remote checksum text is filtered and passed to `sha256sum`, not to a shell. However, the mirror fallback obtains both the archive and checksum from the same mirror, so compromise of that mirror could replace both artifac ...[truncated 1404 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact, reviewed version in both metadata and installation commands. 2. Record and verify package integrity using a lockfile or trusted SHA-512 integrity value. 3. Replace automatic `@latest` upgrades with an explicit user-approved update procedure. 4. Prefer a project-local installation over `npm i -g` and invoke the pinned local binary. 5. Disable npm lifecycle scripts with `--ignore-scripts` where the package can function without them. 6. If lifecycle scripts are required, document and review them before installation. 7. Avoid changing registries automatically. If a mirror is necessary, require explicit user approval and verify artifacts against integrity metadata obtained from an independent trusted source. 8. Run the CLI in a restricted environment with access only to the files and credentials required for image generation.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59
• Finding: API Token Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Sensitive credential passed as a process argument **Risk Level**: Medium ### Vulnerable Code The source instruction uses a non-English API-key placeholder; translated to English, the command is: ```bash qhkit config set --token <API_KEY> --env prod ``` ### Technical Analysis The instruction requires the user or Agent to substitute an API token directly into a command-line argument. Command-line secrets can be exposed through shell history, process listings, debugging telemetry, command transcripts, audit logs, crash reports, or automation logs. Although process visibility varies by operating system and configuration, secrets should not be passed through command arguments when a non-argument credential channel is available. The document mentions `QHKIT_TOKEN` as an alternative, but it does not prioritize secure injection or warn against recording the token in persistent shell history. ### Attack Path 1. A user obtains an API token and provides it to the Agent or substitutes it into the documented command. 2. The Agent executes the command with the plaintext token in its argument vector. 3. The command is retained in shell history, an Agent transcript, execution telemetry, or process-monitoring output. 4. Another local user, administrator, logging-system operator, or attacker with access to those records recovers the token. 5. The attacker reuses the token against the Qinghu service within the permissions and quota assigned to the affected account. ### Impact Assessment Exposure may permit unauthorized API requests, consumption of account credits, access to token-authorized service functions, and association of attacker-generated content with the victim's account. The precise scope is limited by the server-side permissions, expiration, quota, and revocation controls attached to the token. This issue does not directly provide op ...[truncated 161 chars]
• Remediation: ## Remediation Suggestions 1. Replace command-line token entry with an interactive hidden prompt or a standard input mechanism. 2. Prefer a securely injected `QHKIT_TOKEN` environment variable and ensure the value is not printed or persisted in shell initialization files. 3. Support a credentials file with owner-only permissions, such as mode `0600`, where environment-based injection is unavailable. 4. Add explicit instructions not to place the token in shell history, chat messages, command transcripts, or shared logs. 5. Ensure the CLI and Agent redact token values from stdout, stderr, errors, telemetry, and diagnostic output. 6. Use narrowly scoped, short-lived tokens where supported and provide clear rotation and revocation procedures.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill declares that it "must trigger" for broad, common requests like promotional posters, activity images, discount graphics, and brand promo assets. This can cause the agent to over-invoke an external tool for a wide class of generic image-design requests, reducing user choice and increasing the chance that prompts, local file paths, or other user data are unnecessarily sent to the qhkit service.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The trigger examples are broad and do not sharply separate this skill from neighboring tasks such as general poster design, product creatives, or other image-generation/editing skills. In a multi-skill environment this ambiguity can route user requests to the wrong external capability, leading to unintended tool use and possible disclosure of request content or image inputs to an unnecessary third party.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The contract instructs the agent to relay CLI messages as-is and states they are user-facing Chinese, which effectively forces Chinese-language output regardless of the user's language. This can mislead or exclude users, and in security-relevant failure states may prevent them from understanding permission, network, billing, or moderation errors well enough to make informed decisions.

Static analysis

No suspicious patterns detected.