ClawHub
Back to skill

Security audit

AI爆款视频复刻、音频提取 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated video-analysis purpose, but it uses an unpinned third-party CLI that can be installed or upgraded at runtime and can send user links/assets to an external service.

Review before installing. Use it only if you are comfortable installing and running the third-party qhkit npm package, providing a Qinghu API token, and sending supplied video links and selected local media paths to the Qinghu service. Prefer a pinned package version and explicit approval before installs, upgrades, PATH changes, or uploading commercial assets; also check rights before extracting or reusing audio/video content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says the skill 'must trigger' whenever users provide short-video links for replication, script extraction, or audio/BGM extraction. That broad mandatory activation can cause the agent to invoke this skill for common content-analysis requests even when the user did not explicitly consent to external tool use, content copying workflows, or credential-dependent operations. Because the skill can lead to package installation, network retrieval, and third-party processing, over-triggering materially expands attack surface.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs fallback execution via npx @iqinghu/qhkit <命令> ... without pinning a specific version. That causes the latest package to be resolved at runtime, which can unexpectedly change behavior or expose users to a compromised upstream release or dependency chain. In a skill that explicitly self-installs tooling and handles user-supplied links, this increases supply-chain risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

This duplicate finding points to the same persistence behavior: installing Node into a user-controlled directory and prepending it to PATH, potentially across commands and sessions. Persistent path changes can influence later command execution and increase the blast radius if the installed runtime or location is later abused or replaced. In a self-bootstrapping skill, that is a meaningful environmental integrity risk.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

This duplicate finding points to the same persistence behavior: installing Node into a user-controlled directory and prepending it to PATH, potentially across commands and sessions. Persistent path changes can influence later command execution and increase the blast radius if the installed runtime or location is later abused or replaced. In a self-bootstrapping skill, that is a meaningful environmental integrity risk.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

L61 says the skill '对接国内版 iqinghu.com' and instructs the agent to steer users to CN-site credentials unless they explicitly state they use the international account. This imposes a locale-specific default workflow rather than offering a user choice up front.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The '何时触发' section gives only positive examples and omits boundaries for when the skill should not run. In practice, that ambiguity encourages accidental invocation on loosely related requests about videos, imitation, or audio, especially given the broader mandatory language elsewhere. The risk is primarily unintended tool activation and user-data routing rather than direct code execution.

Content

No source excerpt is available for this finding.