电商场景图生成 | 场景合成 | 商品场景 | 营销场景图 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:24 AM UTC
• Version: 0.1.0

Overview

The skill matches its image-generation purpose, but it asks the agent to install and upgrade a third-party CLI globally and handle tokens and uploads with too little user control.

Review before installing. Prefer a pinned, local qhkit install in an isolated environment, confirm before any install or upgrade, do not execute upgrade commands copied from CLI output, and use protected secret handling for the Qinghu token. Only upload product images you are comfortable sending to the Qinghu service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:46
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:46` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ### Technical Analysis The Skill directs the agent to install `@iqinghu/qhkit` without specifying an exact version or integrity value. Consequently, the package content executed during a future invocation may differ from the content available when the Skill was audited. npm installations can execute package lifecycle scripts. The global `-g` installation also places the package and its executable in a shared user or system-level npm location rather than isolating it to the current task. This exceeds the minimum privilege and persistence scope needed to invoke an image-generation client. The risk depends on a compromise of the package, publisher account, npm infrastructure, or configured registry. The repository itself does not establish that the package is malicious. ### Attack Path 1. An attacker compromises the package publisher, a registry account, registry infrastructure, or a package dependency. 2. The attacker publishes a malicious version under the same package name. 3. The agent follows the Skill and runs the unpinned global installation. 4. npm retrieves the current package version and may execute attacker-controlled lifecycle scripts during installation. 5. The installed CLI subsequently runs with the privileges of the account executing the agent. 6. Malicious code can access files, environment variables, network resources, and credentials available to that account. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the agent process's operating-system privileges. Accessible scope may include the user's files, environment variables, API tokens, shell configuration, and network-accessible services. If the installation is run with elevated privileges, the impact could extend to system-wide fi ...[truncated 112 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a reviewed, exact version rather than resolving the current release. - Verify package integrity using a lockfile and registry integrity metadata. - Prefer a project-local installation in a dedicated, unprivileged environment over `npm -g`. - Require explicit user authorization before installing software. - Avoid elevated installation privileges. - Disable lifecycle scripts with `--ignore-scripts` where compatible, or separately review every required lifecycle script. - Allow only trusted registries and avoid silently switching to a mirror. - Consider shipping a reviewed client or using a sandboxed invocation with restricted filesystem, credential, and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:64
• Finding: Execution of Mutable Upgrade Instructions Derived from CLI Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64-67` **Vulnerability Type**: Unvalidated command execution and mutable dependency upgrade **Risk Level**: High ### Vulnerable Code The Skill instructs the agent to obey an upgrade command supplied in a version-gate response and provides the following mutable upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The documented workflow states that when the CLI returns a version-stage response, the response message contains an upgrade command that should be followed directly. Treating runtime output as executable instruction creates a command-injection trust boundary: the installed CLI or its remote backend may influence what command the agent executes. The explicit fallback command also installs `@latest`, making the executed package mutable and preventing the audited Skill from identifying the exact code that will run. Combining response-directed execution with a global, unpinned upgrade increases both command-injection and supply-chain exposure. The repository does not demonstrate an active malicious response. The vulnerability is the absence of local validation, an allowlist, exact version pinning, and user confirmation. ### Attack Path 1. An attacker compromises the installed CLI, its update endpoint, its backend response path, or another component capable of controlling the version-stage message. 2. The compromised component returns a crafted upgrade instruction or directs installation of an attacker-controlled release. 3. The agent interprets the message as an instruction to execute rather than as untrusted data. 4. The agent runs the supplied command or installs the current `@latest` package globally. 5. Attacker-controlled shell behavior, npm lifecycle code, or CLI code executes with the agent account's privileges. ### Impact Assessment A successful attack can result in arbitrary command execution under the agent's account. The attacker could read or ...[truncated 283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never execute commands obtained from CLI output, API responses, error messages, or other runtime-controlled text. - Treat response messages strictly as display data. - Implement a local allowlist of permitted upgrade operations and construct commands from fixed constants. - Pin upgrades to a reviewed exact version and verify integrity before installation. - Require explicit user approval before any installation or upgrade. - Install locally in an isolated environment instead of globally. - Reject shell metacharacters and unexpected arguments if any response-derived value must be processed. - Separate version detection from package installation and perform both through structured, validated data rather than free-form messages. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61
• Finding: API Token Passed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61` **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <key> --env prod ``` ### Technical Analysis The documented configuration command places the API token directly in the process argument list. Depending on the operating system, shell, execution framework, and logging configuration, command-line arguments may be visible through process inspection, shell history, audit logs, telemetry, error reports, or agent transcripts. Although the Skill also mentions an environment-variable alternative, environment variables can likewise be exposed to child processes and diagnostic tooling if not handled through a protected secret mechanism. The documentation does not specify secure input, storage permissions, redaction requirements, or token lifecycle controls. ### Attack Path 1. A user provides an API token to configure the CLI. 2. The agent substitutes the token into the documented command line. 3. The full command is recorded in shell history, execution logs, an agent transcript, or process metadata. 4. Another local user, monitoring component, log reader, or later process obtains the token. 5. The exposed token is reused against the Qinghu service until revoked or expired. ### Impact Assessment An attacker obtaining the token may perform API operations authorized for the associated account, consume paid credits, access account-scoped service functionality, or impersonate the user to the extent permitted by the token. This finding does not independently provide operating-system privilege escalation; its scope is primarily the privileges assigned to the exposed API credential. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Accept the token through protected standard input or an interactive no-echo prompt rather than a command-line argument. - Integrate with the host platform's secret manager or credential store. - Ensure any persisted configuration file has restrictive permissions and encrypt stored credentials where supported. - Redact tokens from stdout, stderr, execution traces, telemetry, and agent transcripts. - Avoid placing secrets in shell history or reusable command examples. - Use short-lived, narrowly scoped tokens where the service supports them. - Document token revocation and rotation procedures. - Ensure child processes receive the token only when required and remove it from the environment immediately afterward. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The metadata description says scene-image generation 'must trigger' for a wide set of common ecommerce/image requests, which can cause the agent to invoke this skill even when the user did not specifically intend to use this external tool. Over-broad mandatory activation increases the chance of unintended tool use, unnecessary package installation, token/config prompts, and sending user-provided images or prompts to a third-party service.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The '何时触发' section uses broad examples such as making scene/lifestyle images for a product or ad creatives, but it does not define exclusions or thresholds that distinguish this skill from generic image editing or generation. In context, that ambiguity makes unintended invocation more likely and can route ordinary requests into an external CLI workflow that may install software, require credentials, and transmit assets off-platform.

Static analysis

No suspicious patterns detected.