AI视频角色替换 | 换人 | 人物替换 | 角色换脸 | 模特换脸 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:25 AM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent for video role replacement, but its installation and upgrade instructions give too much trust to a third-party CLI and remote update messages.

Review this skill before installing. It appears intended for a legitimate cloud video role-swap workflow, but only use it when you have rights to the person or likeness being replaced, and avoid letting an agent automatically run upgrade commands copied from qhkit output. Prefer a pinned, isolated install over a global @latest install, and treat returned messages as text to show the user rather than commands to execute.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Unpinned Global Installation of a Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md`, lines 35–42 and 57–63 **Vulnerability Type**: Unsafe and unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions install `@iqinghu/qhkit` globally without pinning it to an audited version or integrity value. The upgrade procedure explicitly installs the latest available release. As a result, the package executed by the agent can differ from the version that existed when the Skill was reviewed. npm packages may execute lifecycle scripts during installation. A global installation makes the package and its commands available across the user environment rather than limiting them to an isolated project directory. This exceeds the minimum installation scope necessary to invoke the CLI for one task. ### Technical Analysis The security of the Skill depends on the continued integrity of the npm package, its publisher account, its transitive dependencies, and the selected registry. If any part of that supply chain is compromised, a malicious release could execute code during installation or when `qhkit` is subsequently invoked. The documented mirror fallback introduces another source from which package metadata and content may be obtained. No lockfile, exact package version, npm integrity value, signature verification, or independent package validation is specified. ### Attack Path 1. An attacker compromises the npm publisher account, package, registry path, mirror, or a transitive dependency. 2. The attacker publishes a malicious release as the current or latest version. 3. The agent follows the Skill instructions and runs the global installation or upgrade command. 4. Malicious lifecycle code may execute during installation, or malicious package code may execute when `qhkit` is invoked. 5. The payload operates with the permissions of the ...[truncated 614 chars]
• Remediation: ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specific audited version rather than installing an unqualified or `latest` release. - Use a lockfile and verify npm integrity metadata before installation. - Prefer a project-local, user-scoped, or isolated installation instead of a global installation. - Require explicit user approval before installing or upgrading third-party software. - Do not automatically upgrade solely because a package or remote service reports that a newer version exists. - Review transitive dependencies and package lifecycle scripts before approving a release. - Consider using `npm install --ignore-scripts` when the package can operate without lifecycle scripts. - Restrict execution through sandboxing, a container, or a dedicated low-privilege account.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45
• Finding: Node Archive Extraction Is Not Atomically Conditional on Successful Checksum Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 45–53 **Vulnerability Type**: Non-fail-fast download verification and unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH" ``` The flagged command is not a direct `curl | bash` construct. It downloads a checksum manifest and passes that data to `grep` and `sha256sum`, not to a shell interpreter. This is safer than directly executing downloaded shell code. Nevertheless, the checksum verification and extraction commands are separate. In an ordinary interactive shell or pasted multiline command block without fail-fast behavior, failure of `curl`, `grep`, or `sha256sum` does not inherently stop the next line from extracting the archive. ### Technical Analysis The prose states that extraction must occur only after verification reports success, but the shell syntax does not enforce this invariant. The block does not enable `set -euo pipefail`, and extraction is not chained to successful verification with `&&`. Pipeline handling is also relevant. Without `pipefail`, the status of a pipeline is generally determined by its final command. Although `sha256sum -c -` will commonly fail when it receives invalid or empty input, explicit fail-fast handling is still necessary to make the intended security boundary reliable. The fixed path `/tmp/node-v22.22.3-linux-x64.tar.xz` is shared and predictable. Another local process could potentially create or replace that path when multiple users or concurrent processes share `/tmp`. The mirror fallback a ...[truncated 1305 chars]
• Remediation: ## Remediation Suggestions Use a fail-fast block and make extraction explicitly dependent on successful verification: ```bash set -euo pipefail tmp_dir="$(mktemp -d)" trap 'rm -rf "$tmp_dir"' EXIT archive="$tmp_dir/node-v22.22.3-linux-x64.tar.xz" checksums="$tmp_dir/SHASUMS256.txt" curl --proto '=https' --tlsv1.2 -fsSLo "$archive" \ https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz curl --proto '=https' --tlsv1.2 -fsSLo "$checksums" \ https://nodejs.org/dist/v22.22.3/SHASUMS256.txt ( cd "$tmp_dir" grep ' node-v22.22.3-linux-x64.tar.xz$' SHASUMS256.txt | sha256sum -c - ) && { mkdir -p "$HOME/.local/lib" tar -xJf "$archive" -C "$HOME/.local/lib" } ``` - Use a private directory created by `mktemp -d` instead of a predictable shared path. - Delete the archive immediately after any verification failure. - Pin the expected digest in reviewed Skill content or verify a cryptographically signed release manifest through an independently trusted key. - Do not treat an archive and checksum obtained from the same untrusted mirror as fully independent verification. - Validate archive entries before extraction to prevent absolute-path or traversal entries.

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:57
• Finding: Externally Influenced CLI Output Is Trusted as an Upgrade Command## Vulnerability Details **File Location**: `SKILL.md`, lines 57–63 **Vulnerability Type**: Indirect command injection through trusted tool output **Risk Level**: High ### Vulnerable Instruction The source instruction states, in English translation: > If the command returns a version-gate response, the message contains the upgrade command; execute it as instructed. The same section supplies the following upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` This tells the agent to treat a message emitted by the CLI as executable operational guidance. The message may be influenced by the installed package or by a remote API response. It therefore crosses a trust boundary and must be handled as untrusted data rather than as a shell command. ### Technical Analysis Tool stdout, stderr, JSON fields, and remote service messages are data. Allowing those fields to determine commands creates an indirect command-injection channel. An agent following natural-language instructions may execute arbitrary shell syntax embedded in a malicious `message` value, even if the Skill itself does not contain that syntax. The risk is elevated because the CLI communicates with an external service and the instructions explicitly say to follow the returned upgrade command. A compromised package, service, API response, or network-adjacent component able to control the message could exploit this trust. ### Attack Path 1. An attacker compromises the installed CLI, its update-check mechanism, or the remote service that supplies the version-gate response. 2. The attacker returns a crafted `message` containing an arbitrary shell command presented as an upgrade instruction. 3. The agent interprets the message according to the Skill instruction. 4. The agent executes the attacker-provided command in the local shell. 5. The command runs with the permissions and environment of the agent account. An alternative path is to direct the agent to ...[truncated 698 chars]
• Remediation: ## Remediation Suggestions - Never execute shell commands copied from CLI output, API responses, error messages, or version-gate messages. - Treat every returned `message` field as display-only untrusted text. - Replace the instruction with a fixed local allowlist of permitted maintenance operations. - Permit upgrades only to an explicitly approved and pinned version. - Parse version information as structured data and validate it against a strict semantic-version pattern. - Reject messages containing shell metacharacters, URLs, package names, registry overrides, or additional command-line arguments. - Require explicit user confirmation before any installation or upgrade. - Perform upgrades in an isolated, low-privilege environment and verify package integrity before execution. - Report unexpected upgrade instructions to the user instead of executing them.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description says the skill 'must trigger' for broad, common requests like video face swap or replacing a person in a video. That can cause the agent to invoke this capability without sufficient disambiguation, consent checks, or policy review, increasing the chance of unauthorized impersonation or misuse of a deepfake-style tool.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The activation guidance gives examples of when to use the skill but provides limited boundaries for when not to use it, especially for consent-sensitive face/identity replacement scenarios. In a role-swap/deepfake context, missing negative guidance increases the risk of the agent selecting this skill for unsafe or unauthorized requests.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: qinghu-video-role-swap
description: 上传原视频及新角色图，一键替换原视频中的人物角色，动作口型保持不变。当用户要求换视频里的人、视频换脸、角色替换、数字人替换、模特视频本地化时必须触发。关键词：青虎AI、qhkit、角色替换、视频换人、视频换脸、人物替换、数字人替换、模特替换、视频本地化。
user-invocable: true
homepage: https://www.npmjs.com/package/@iqinghu/qhkit
metadata: {"openclaw":{"emoji":"🧑‍🎤","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}}

• Confidence: 89% confidence
• Finding: The metadata includes coercive routing language such as 'must trigger' embedded in the description, which is a classic tool-selection poisoning pattern. In this context, the skill enables face/person replacement in videos, so poisoned metadata can bias the agent toward invoking a sensitive impersonation-capable tool for loosely related requests.

Static analysis

No suspicious patterns detected.