Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid video-generation workflow that uploads user-provided children’s clothing media to an external service, with no artifact evidence of hidden or destructive behavior.
Install only if you are comfortable sending the reference video and child model image to Qinghu/iqinghu for paid processing. Confirm that you have rights to the media and guardian authorization for any minor’s likeness, review the credit estimate before generation, and prefer a pinned or preinstalled qhkit package if you want tighter supply-chain control.
The metadata says the skill 'must trigger' for a broad set of user intents without meaningful exclusions. Overbroad mandatory triggering can cause the agent to invoke this skill in the wrong context, leading to unnecessary handling of sensitive media, unintended spending, or bypass of safer/more appropriate workflows.
The '何时触发' examples use broad phrases like making a children's clothing promo video or changing the child model, but do not clearly require motion transfer or the necessary source inputs. In an agentic system, this ambiguity can misroute many adjacent requests into a paid external workflow, increasing privacy, billing, and policy risks around minors' imagery.
The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact version, which allows whatever package version is current at execution time to be fetched and run. That creates supply-chain risk and weakens reproducibility, especially because the command may be executed automatically in an agent environment with user-controlled triggering.
This duplicate finding points to the same behavior: unpacking executables into a user-controlled directory and prepending that directory to PATH, with advice that can persist across sessions. In the context of an agent skill that may bootstrap its own toolchain, this broadens trust boundaries and can affect future task execution in unintended ways.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same behavior: unpacking executables into a user-controlled directory and prepending that directory to PATH, with advice that can persist across sessions. In the context of an agent skill that may bootstrap its own toolchain, this broadens trust boundaries and can affect future task execution in unintended ways.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
L120 指出“转述 CLI 的 message（已是面向用户的中文）”，结合全文均以中文固定规定交付与说明方式，体现出默认且强约束的中文输出倾向。文档中未说明可根据用户语言偏好切换语言，也未提供显式的语言选择或例外。