AI电商带货脚本 | 脚本生成 | 口播文案 | 种草脚本 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:24 AM UTC
• Version: 0.1.0

Overview

This skill matches its sales-script purpose, but it gives the agent broad setup authority to install and upgrade executable tools and handle an API token with limited user control.

Install only if you are comfortable with the agent using Qinghu/qhkit, uploading task inputs to that service, and managing a qhkit API token. Require confirmation before any npm install, npx run, Node download, PATH or shell-profile change, or qhkit upgrade, and prefer a pinned, isolated installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:37
• Finding: Unpinned Third-Party CLI Is Installed and Executed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37–43 **Vulnerability Type**: Third-party supply-chain exposure through an unpinned global package installation **Risk Level**: High ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The fallback installation mechanism is: ```bash npx @iqinghu/qhkit <command> ... ``` The instructions also permit changing the package source to: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill requires the Agent to retrieve and execute the third-party `@iqinghu/qhkit` package, but it does not pin an exact package version or integrity digest. The package implementation is not included in the audited project, so its behavior cannot be verified from the repository. A global npm installation increases the impact of dependency compromise because it places executable content in the user's global npm environment. The `npx` fallback can likewise retrieve and immediately execute a mutable package release. npm lifecycle scripts may run during installation unless explicitly disabled. Using an alternate registry adds another package-distribution trust boundary. Although the documented mirror is presented as a network fallback and there is no evidence that it is malicious, package availability or integrity discrepancies between registries could increase supply-chain exposure. The global installation is broader than the minimum privileges required to invoke a task-specific CLI. A project-local, isolated, and version-pinned installation would reduce the affected scope. ### Attack Path 1. An attacker compromises the npm package publisher account, package distribution infrastructure, or an accepted registry response. 2. The attacker publishes a malicious release under the expected package name. 3. The Agent follows the Skill instructions and runs the unpinned global installation or `npx` command. 4. Malicious lifecycle code may execute during installation, or mal ...[truncated 951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed, exact version rather than resolving an unspecified or mutable release. 2. Record and verify the package integrity digest or lockfile integrity metadata. 3. Prefer a project-local installation in an isolated directory or container instead of `npm i -g`. 4. Avoid automatic `npx` retrieval. If `npx` is required, specify an exact reviewed version. 5. Disable npm lifecycle scripts with `--ignore-scripts` where compatible with the package. 6. Audit the package contents, transitive dependencies, and lifecycle hooks before authorizing execution. 7. Restrict package installation and execution with filesystem, network, and environment-variable sandboxing. 8. Use a single trusted registry with integrity verification. Do not silently switch registries. 9. Request explicit user approval before installing or upgrading executable dependencies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58
• Finding: Agent Is Instructed to Execute an Upgrade Command Supplied Through CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–61 **Vulnerability Type**: Command injection through untrusted, remotely influenced diagnostic output **Risk Level**: High ### Vulnerable Instruction and Code Snippet The Skill states that when a version-gate error occurs, the response's `message` field contains the upgrade command and the Agent should execute it directly. It then provides the following standard upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` The relevant expected failure format is documented elsewhere as: ```json {"ok":false,"stage":"version","message":"..."} ``` ### Technical Analysis The instruction treats the CLI's `message` field as executable guidance rather than untrusted text. That output may be influenced by the installed CLI, its remote backend, or an intermediary response. No command allowlist, parser, signature check, or user-confirmation boundary is specified before execution. If the CLI or backend is compromised, the returned `message` can contain a shell command different from the expected npm upgrade. Following the instruction to execute the message directly would cross a data-to-code boundary and create a command-injection path. Even the hard-coded fallback uses the mutable `latest` tag, so an upgrade can install a package version that did not exist when the Skill was audited. ### Attack Path 1. An attacker compromises the `qhkit` package, its backend service, or another component capable of controlling the version-gate response. 2. The Agent invokes `qhkit`, and the compromised component returns a response such as: ```json {"ok":false,"stage":"version","message":"<attacker-controlled command>"} ``` 3. The Skill instructs the Agent to treat the `message` value as an upgrade command and execute it. 4. The shell interprets the attacker-controlled content. 5. The attacker obtains code execution with the privileges of the Agent account. Alternatively, an attacker who controls ...[truncated 769 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never execute text returned in a CLI `message`, stderr, API response, or other diagnostic channel. 2. Treat the message as display-only data and escape it before presenting it to a user. 3. Replace remotely supplied commands with a hard-coded allowlist of supported maintenance operations. 4. Pin upgrades to an exact reviewed package version and verify package integrity before installation. 5. Require explicit user approval before any installation or upgrade. 6. Parse version-gate responses as structured data and accept only documented fields with strict schemas. 7. Reject responses containing shell metacharacters or unexpected command content, but do not rely on filtering as a substitute for eliminating dynamic command execution. 8. Run upgrade operations in an isolated, least-privileged environment with restricted access to secrets and local files. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to install Node.js, globally install/upgrade a third-party CLI, and modify PATH as part of normal operation, which materially expands the skill's capabilities beyond script generation. This creates supply-chain and environment-modification risk, especially because the instructions encourage autonomous setup rather than requiring explicit user approval for system changes.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to obtain, set, and use an API token for qhkit, introducing credential collection and configuration behavior that is not clearly bounded by the skill's stated content-generation purpose. This can lead to unnecessary handling of secrets, token persistence in the environment, and accidental disclosure or misuse if the agent logs, echoes, or stores the credential insecurely.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The manifest states the skill 'must' trigger for a wide range of common e-commerce writing requests, making invocation overly broad for ordinary user prompts. In context, this is dangerous because triggering this skill can cascade into package installation, token setup, and external CLI usage even when the user only asked for generic copywriting help.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill contains shell commands that install software, upgrade packages, download binaries, and alter the execution environment, but it does not require a user-facing warning or consent gate before those changes. Given the skill context, this increases the risk of silent host modification and supply-chain exposure from a capability that users would reasonably expect to only generate sales scripts.

Static analysis

No suspicious patterns detected.