Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid qhkit workflow for generating TVC advertising videos from user-provided product images, with expected external uploads and credit usage.
Install only if you are comfortable trusting the qhkit npm package and the iqinghu service with your product images, API token configuration, and paid credit usage. Confirm the estimate before generation, avoid uploading unlicensed or sensitive assets, and prefer pinned or reviewed package versions in controlled environments.
The description says this skill 'must trigger' for a broad set of common advertising requests, which can cause overbroad activation and unnecessary delegation. In an agent setting, broad mandatory triggers can override user intent, increase the chance of unintended tool use, and funnel many generic requests into a third-party workflow that may consume credits or expose user assets.
The skill recommends falling back to npx @iqinghu/qhkit without pinning an exact version. That causes execution of whatever package version is current at runtime, expanding supply-chain risk and reducing reproducibility if a compromised or breaking release is published.
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and exporting it into PATH. In a tool-executing agent context, such setup can outlive the current task and broaden the blast radius of any upstream compromise or later misuse of the installed runtime.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and exporting it into PATH. In a tool-executing agent context, such setup can outlive the current task and broaden the blast radius of any upstream compromise or later misuse of the installed runtime.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"