Security audit

AI视频音频提取 | 提取背景音乐 | 人声提取 | 视频转音频 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its setup asks for a production API token in chat and installs an unpinned global npm tool, which users should review before installing.

Install only if you are comfortable with a global npm CLI being installed and with qhkit being configured for your account. Prefer installing a reviewed, pinned qhkit version yourself, use the official registry, configure the API key locally instead of pasting it into chat, and revoke or rotate any token that was shared through conversation or logs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Global Installation of an Executable Third-Party Package## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable code snippet**: ```bash npm i -g @iqinghu/qhkit npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com ``` ### Technical Analysis The skill instructs the agent to globally install and execute the latest available version of `@iqinghu/qhkit`. The dependency is not pinned to an audited version, and no package integrity, signature, or checksum verification is required. An npm installation may execute package lifecycle scripts, including installation hooks, with the privileges of the account running npm. A global installation also places executable files into shared system or user-level locations. Consequently, compromise of the package publisher, a newly introduced malicious package version, or compromise of the optional registry mirror could turn this installation step into arbitrary code execution. Use of the mirror expands the supply-chain trust boundary beyond the package's primary registry. The audit found no evidence that the named package is currently malicious; the vulnerability is the unsafe dependency acquisition and execution process. ### Attack Path 1. An attacker compromises the package publisher, publishes a malicious later version, or compromises the optional registry infrastructure. 2. The skill is invoked on a system where `qhkit` is unavailable. 3. Following the skill instructions, the agent executes the unpinned global npm installation. 4. npm downloads the attacker-controlled package release. 5. Malicious lifecycle scripts execute during installation, or malicious logic executes when the installed CLI is invoked. 6. The payload operates with the privileges of the user running npm and can access resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the agent's o ...[truncated 503 chars]
Remediation: ## Remediation Suggestions - Pin the dependency to a specifically reviewed version rather than installing the latest release. - Record and verify the expected package integrity hash before execution. - Prefer a project-local, isolated installation over a global installation. - Use the official npm registry unless an independently verified mirror is required. - Run installation and execution in a sandbox or container with minimal filesystem and network permissions. - Disable npm lifecycle scripts where compatible with the package, and separately review any scripts that must run. - Document the reviewed package version, publisher identity, registry source, and update procedure. - Require security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:29
Finding: API Token Exposure Through Chat and Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Vulnerable code snippet**: ```bash qhkit config set --token <API_KEY> --env prod ``` The surrounding instruction directs the user to provide the created API key to the agent before this command is executed. ### Technical Analysis The documented workflow asks the user to disclose an API credential to the agent and then places that credential directly in a command-line argument. This creates several independent secret-exposure channels: - The token may remain in conversation history or agent execution records. - Tool-call arguments and command output may be captured by application telemetry. - The command may be retained in shell history. - Command-line arguments may be observable through local process-inspection facilities while the command is running. - The configured token may be written to local storage without the skill documenting file permissions, encryption, retention, or deletion requirements. API tokens should be treated as secrets and should not be transmitted in ordinary chat messages or embedded in command arguments. Although no hardcoded credential exists in the project, the prescribed credential-handling process can expose a user-supplied production token. ### Attack Path 1. The user creates a production API token as directed. 2. The user sends the token to the agent through the conversation. 3. The agent inserts the token into the `qhkit config set` command. 4. The plaintext token is retained in one or more locations, such as chat history, tool logs, shell history, process metadata, or a configuration file. 5. An attacker or unauthorized operator with access to one of those records retrieves the token. 6. The attacker uses the token against the Qinghu API until it is revoked or expires. ### Impact Assessment A disclosed token could p ...[truncated 514 chars]
Remediation: ## Remediation Suggestions - Do not instruct users to send API tokens through chat. - Require users to configure credentials themselves through a trusted local interface. - Use a secret manager, protected credential store, or hidden-input prompt. - If supported, pass the token through a protected environment variable or standard input rather than a command-line argument. - Ensure configuration files containing credentials are created with restrictive user-only permissions. - Prevent secret values from appearing in logs, command echoes, exception messages, and tool-call records. - Clearly document token storage location, retention behavior, revocation procedures, and required file permissions. - Recommend narrowly scoped, short-lived tokens where the service supports them. - Rotate and revoke any token previously disclosed through conversation or execution logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill declares mandatory triggering on broad, colloquial phrases such as '视频转音频' and '扒BGM', which can cause the agent to invoke the skill in ambiguous contexts without sufficient user confirmation. In a skill that can install tools, fetch remote media, and process user-provided URLs, overbroad triggering increases the chance of unintended execution and exposure to risky follow-on actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to obtain an API token from the user and use it in a shell command, but it does not warn that the token is sensitive or require secure handling. This creates a real credential-exposure risk because users may paste secrets into chat, command history, logs, or transcripts, and the skill normalizes the collection of those secrets for third-party service access.

Static analysis

No suspicious patterns detected.