Security audit
Security checks for vulnerabilities and agentic risk
This video-generation skill is not malicious, but it should be reviewed because it can automatically install and update unpinned tools, change the user environment, and persist service credentials after broad triggers.
Review before installing. Only use this skill if you are comfortable letting it install or update npm/Node tooling, upload product media to the Qinghu service, and store a qhkit API token for later use. Prefer a preinstalled, pinned qhkit version and a secure secret manager instead of ad hoc token entry or shell-profile changes.
The manifest description says requests for product or sales videos 'must trigger', using broad keywords that can match many common user intents. Overly broad mandatory triggering increases the chance that the skill runs unexpectedly, causing unintended tool execution, installation attempts, or credential prompts in contexts where the user did not clearly consent.
The 'when to trigger' examples are broad and provide no exclusion criteria or disambiguation rules. In combination with the skill's installation and configuration behavior, this makes accidental invocation more dangerous because normal image/video editing requests may activate a workflow that modifies the environment or requests credentials.
The skill goes well beyond describing video generation and actively instructs runtime bootstrapping, package installation, Node installation, PATH modification, mirror selection, and upgrade flows. This expands the skill's operational scope from content generation to environment modification, increasing the attack surface and making it easier for a prompt-triggered skill to alter the host system unexpectedly.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows execution of whatever package version is current at invocation time. That creates a supply-chain risk: a compromised latest release or unexpected breaking change could execute unreviewed code in the agent environment.
This duplicate finding reflects the same persistence behavior: unpacking binaries into the user's home directory and exporting a new PATH for subsequent use. In a skill context, persistent environment modification is risky because it extends the effect of a single invocation into future sessions and workflows.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding reflects the same persistence behavior: unpacking binaries into the user's home directory and exporting a new PATH for subsequent use. In a skill context, persistent environment modification is risky because it extends the effect of a single invocation into future sessions and workflows.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs operators to collect API keys from a website and persist them via qhkit config set or environment variables. Credential collection and persistent configuration are higher-risk operations than the declared video-generation purpose and can lead to secret exposure, cross-session reuse, or accidental use of the wrong account/site.