ClawHub
Back to skill

Security audit

商品视频画质提升 | 视频超清 | 画质增强 | 高清放大 | LinkPix

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks agents to install and update a mutable global CLI and use a paid external video service, so users should review it carefully before enabling it.

Install only if you trust the @iqinghu/qhkit npm package and Qinghu service, are comfortable uploading selected videos to that service, and understand token and credit use. Prefer confirming before any install, upgrade, token setup, or paid generate call; avoid automatic @latest upgrades where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:64
Finding
Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64-68` and `SKILL.md:91-95` **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The documented fallback may also retrieve and immediately execute the package through `npx`: ```text npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly selects the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install `@iqinghu/qhkit` without pinning an exact audited version. It also permits execution through `npx` and directs the Agent to upgrade automatically to the package registry's `latest` release. An npm installation can run package lifecycle scripts with the privileges of the invoking user. A global installation additionally places a mutable executable on the user's command path. The `npx` fallback can retrieve and execute the package directly, while the `@latest` command expressly allows the effective code to change after this Skill has been reviewed. The document permits both the default npm registry and a registry mirror. Consequently, security depends on the package maintainer account, package registry, mirror, and their associated distribution infrastructure. The audit found no evidence that the referenced package is currently malicious; the vulnerability is the absence of controls ensuring that the installed code is the version that was reviewed. The Skill's video-processing functionality does not inherently require a global, automatically updated installation. A pinned, project-local, integrity-verified installation would provide the required CLI with a smaller trust and privilege footprint. ### Attack Path 1. An attacker compromises the npm package maintainer account, registry publication process, mirror, or another relevant supply-chain component. 2. The attacker publishes a malicious version ...[truncated 1391 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed: ```bash npm install --save-exact @iqinghu/qhkit@<audited-version> ``` 2. Remove automatic installation of `@latest`. Treat upgrades as a separate, explicit operation requiring user approval and security review. 3. Prefer a project-local installation over a global installation, and invoke the pinned binary from the local dependency directory. 4. Commit a lockfile containing npm integrity metadata, or independently publish and verify a cryptographic digest for the approved package artifact before installation. 5. Avoid an unpinned `npx` fallback. If `npx` is necessary, specify the exact approved version and prevent it from silently selecting another release. 6. Disable npm lifecycle scripts during installation where the package's operation permits it: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@<audited-version> ``` 7. Run the CLI in a restricted environment with access limited to the selected input video, required network endpoints, and a narrowly scoped API token. 8. Require explicit user confirmation before installing or upgrading executable dependencies, and clearly identify the registry or mirror that will be trusted. 9. Document a verified package provenance mechanism, such as signed releases, registry provenance attestations, or reproducible package hashes. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description uses broad quality-related phrases together with a mandatory trigger requirement, which can cause the agent to invoke this paid external workflow in situations where the user did not clearly request video upscaling. In this context, over-triggering is risky because the skill can lead to unnecessary tool use, billing, and user confusion, especially since the workflow involves credits and remote processing.

Static analysis

No suspicious patterns detected.