ClawHub
Back to skill

Security audit

AI视频角色替换 | 换人 | 人物替换 | 角色换脸 | 模特换脸 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent video role-swap integration, but users should understand it installs and updates a CLI and uploads chosen media to a third-party service.

Install only if you trust the qhkit npm package and Qinghu service with the specific videos, images, and API token you provide. Confirm you have rights to any person’s likeness before using it, and prefer a pinned/approved qhkit version or managed environment if reproducibility matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: qinghu-video-role-swap
description: 上传原视频及新角色图，一键替换原视频中的人物角色，动作口型保持不变。当用户要求换视频里的人、视频换脸、角色替换、数字人替换、模特视频本地化时必须触发。关键词：青虎AI、qhkit、角色替换、视频换人、视频换脸、人物替换、数字人替换、模特替换、视频本地化。
user-invocable: true
homepage: https://www.npmjs.com/package/@iqinghu/qhkit
metadata: {"openclaw":{"emoji":"🧑‍🎤","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says requests about changing people in videos 'must trigger', using broad keywords that can match many normal user requests. Over-broad mandatory triggering can cause unintended tool execution, sending user media to an external service when the user did not clearly consent to that specific provider or workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs fallback execution via npx @iqinghu/qhkit <命令> ... without pinning a specific version. That makes execution dependent on whatever package version is current at runtime, increasing supply-chain risk and reducing reproducibility if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The same installation block promotes user-level binary installation and path persistence, which can leave long-lived executables available for future sessions. Even with checksum verification, persistent environment changes are risky in an agent skill because they alter the host outside the immediate task boundary.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The same installation block promotes user-level binary installation and path persistence, which can leave long-lived executables available for future sessions. Even with checksum verification, persistent environment changes are risky in an agent skill because they alter the host outside the immediate task boundary.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text