Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Qinghu AI video-generation workflow, but users should understand it may upload media, consume paid credits, and install or update a Node CLI tool.
Install only if you are comfortable using Qinghu's qhkit CLI, uploading the referenced video and model image to that service, and spending Qinghu credits after the estimate. Prefer a pinned or already-installed qhkit version where possible, and only provide media and API tokens you are authorized to use.
The metadata says this skill 'must trigger' for broad apparel-video requests, which can force invocation in many ordinary user contexts without strong disambiguation. Over-broad routing increases the chance of unintended tool use, unnecessary external service calls, and accidental transfer of user media to a third-party workflow.
The listed trigger phrases are short and ambiguous, such as generic requests to make a menswear promotional video or swap a model. In this skill context, that can cause inadvertent invocation for common creative requests and send user assets into a paid third-party generation pipeline without sufficiently clear consent.
The skill recommends falling back to npx @iqinghu/qhkit <命令> ... without pinning a specific version. That causes execution of whatever package version is current at invocation time, which introduces supply-chain risk and non-deterministic behavior if the upstream package is compromised or publishes a breaking change.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"