ClawHub
Back to skill

Security audit

爆款童装视频模仿 | 童装带货 | 儿童模特 | 动作迁移 | LinkPix

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated Qinghu video workflow, but it deserves review because it installs a mutable third-party CLI and uses broad triggers around paid processing of children's media.

Review this before installing if you will process children's images or commercial videos. Use only authorized media, confirm the quote before generation, prefer a pinned or isolated qhkit install, avoid elevated/global installs where possible, and understand that the CLI uploads supplied files to Qinghu's service using your token.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:74
Finding
Unpinned Third-Party CLI Installation and Automatic Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:74-81, 105-109` **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit execution through `npx`, which can download and immediately execute the package without a locally reviewed installation. ### Technical Analysis The Skill instructs the agent to install and execute the third-party npm package `@iqinghu/qhkit` globally. It also recommends upgrading to the mutable `latest` release. No exact package version, npm integrity digest, lockfile, vendored implementation, or reproducible verification procedure is supplied. Consequently, the code that ultimately runs can change independently of the reviewed `SKILL.md`. A compromised package release, npm publisher account, registry response, mirror, or future upstream version could introduce arbitrary lifecycle scripts or malicious CLI behavior. The package is central to the declared cloud-generation functionality, so using a dependency is legitimate. However, globally installing an unpinned release exceeds the minimum safe installation model. The user-directory Node installation at lines 87-92 is not a remote-script execution issue: it downloads an archive and verifies it using the publisher's checksum manifest before extraction. The pipe on line 88 sends checksum data through `grep` to `sha256sum`; it does not pipe remote code into a shell. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, registry, or an allowed mirror. 2. The attacker publishes a malicious version of `@iqinghu/qhkit`, potentially under the `latest` tag. 3. The agent follows the Skill's bootstrap or upgrade instructions and runs `npm i -g @iqinghu/qhkit` or `npm i -g @iqinghu/qhkit@latest`. 4. npm installs the attacker-controlled package and may execute packag ...[truncated 1021 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using an unconstrained release or the `latest` tag. 2. Record and verify the expected npm integrity digest for the pinned package. 3. Remove automatic upgrade instructions. Require explicit user approval and security review before changing versions. 4. Prefer a project-local installation backed by a committed lockfile over a global installation. 5. Avoid automatic `npx` retrieval and execution. If `npx` is necessary, specify an exact version and prevent it from silently selecting a different release. 6. Where compatible with the package, install with lifecycle scripts disabled and separately review any scripts that are operationally required. 7. Run the CLI in a sandbox with access limited to the specific input files, output directory, token, and network destinations required for the workflow. 8. Never resolve permission failures by granting unnecessary administrative privileges. Use a user-owned package directory or isolated environment instead. 9. Document the external service, media-upload behavior, credential use, and retention policy so users can provide informed consent before sensitive files are transmitted. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger text mandates activation for broad, common requests such as making a kids clothing promo video or changing a child model, without requiring strong disambiguation. This can cause the agent to invoke the skill in situations where the user did not clearly request this specific external workflow, increasing the chance of unintended tool use, unnecessary spending, or processing of sensitive child-related media.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The '何时触发' examples are vague and cover everyday-style requests like making a kids promotional video or swapping the child model. In an agent setting, such broad examples can over-match normal conversation and route users into a paid external media-processing flow involving minors' images, even when a simpler or safer response would be more appropriate.

Static analysis

No suspicious patterns detected.