AI爆款视频复刻、音频提取 | 青虎AI

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:26 AM UTC
• Version: 0.1.0

Overview

The skill’s video workflow is understandable, but it asks agents to install and update third-party tooling globally and handle API tokens in ways users should review before use.

Install only if you are comfortable with qhkit, npm, and Qinghu service access. Prefer a local, pinned installation, avoid passing API tokens directly on the command line, confirm rights before processing third-party videos or audio, and approve any package install, PATH change, upload, or paid generation step explicitly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42
• Finding: Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42-45 and 63-66 **Vulnerability Type**: Unpinned dependency installation and unsafe supply-chain execution **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit using an alternate registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute `@iqinghu/qhkit` without pinning an exact, reviewed package version or validating package integrity. The explicit use of `@latest` makes the effective executable payload mutable after the Skill has been audited. The `npx` fallback can similarly retrieve and immediately execute the current package version. An npm package can execute code through lifecycle scripts during installation and through its CLI entry point when invoked. Consequently, compromise of the package publisher, npm account, package release, official registry, or permitted mirror could result in attacker-controlled code running under the Agent user's account. Global installation is also broader than necessary for isolated Skill execution. It changes the user's shared Node.js environment and can expose the package to unrelated sessions. Although the instructions avoid mandatory privilege escalation, a global installation may encourage elevated execution when the normal user lacks write permission. ### Attack Path 1. An attacker compromises the package publisher, registry account, distribution infrastructure, or permitted mirror. 2. The attacker publishes a malicious version under the legitimate `@iqinghu/qhkit` package name. 3. The Agent follows the Skill instructions and runs an unpinned global installation, `npx`, or the explicit `@latest` upgrade. 4. npm retrieves the attacker-controlled release. 5. Malicious lifecycle scripts execute during installation, or malic ...[truncated 1024 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed: ```bash npm install --no-save --ignore-scripts @iqinghu/qhkit@<reviewed-version> ``` 2. Record and verify the package integrity value from a trusted source before execution. 3. Replace global installation with a project-local installation in an isolated temporary directory or container. 4. Avoid `npx` without an exact version. If it remains necessary, specify the reviewed version and prevent implicit package substitution. 5. Remove instructions to automatically install `@latest` or to obey upgrade commands returned by the dependency. New versions should undergo review before deployment. 6. Disable npm lifecycle scripts with `--ignore-scripts` where the package can function without them. If scripts are required, inspect them before installation. 7. Run the CLI as a dedicated, unprivileged user with access limited to the specific input files required for the operation. 8. Restrict outbound network access to documented service endpoints and obtain user approval before uploading local media. 9. Treat registry mirrors as separate trust boundaries. Permit only explicitly approved registries and retain integrity verification regardless of the selected registry. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Sensitive credential passed as a process argument **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <key> --env prod ``` ### Technical Analysis The Skill instructs users or Agents to place the Qinghu API token directly in a command-line argument. Depending on the shell and operating system, command arguments may be exposed through shell history, process inspection facilities, terminal capture, debugging output, automation logs, or Agent transcripts. Even if the CLI subsequently stores the token securely, exposure can occur before the command finishes. Other processes or users with sufficient local process-inspection permissions may be able to observe the argument while it is running. Persistent shell history and orchestration logs can preserve the credential for substantially longer. The Skill offers `QHKIT_TOKEN` as an alternative, but it does not make the safer mechanism mandatory or explain how to avoid accidental logging. Environment variables also require protection because they can be exposed to child processes and diagnostic tools. ### Attack Path 1. The user obtains an API token and substitutes it into the documented command. 2. The command is executed by an interactive shell, Agent tool, terminal recorder, or automation platform. 3. The plaintext token is stored in shell history or logs, or is visible temporarily through process-argument inspection. 4. An attacker with access to those records or local inspection interfaces retrieves the token. 5. The attacker authenticates to the Qinghu service using the stolen credential. 6. The attacker consumes account credits, accesses any resources authorized to that token, or submits operations under the victim's account until the token is revoked. ### Impact Assessment The exposed token could allow unauthorized use of the associated Qinghu account and API capabilities. Potential co ...[truncated 424 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pass secrets as command-line arguments. 2. Prefer an interactive hidden-input prompt or provide the token to the CLI through standard input. 3. If `QHKIT_TOKEN` must be used, inject it through the execution environment without echoing it or including it in generated shell commands. 4. Ensure Agent transcripts, command logs, diagnostic output, and error messages redact token values. 5. Store persistent credentials in an operating-system credential manager or a configuration file restricted to the owning user, such as mode `0600` on Unix-like systems. 6. Avoid placing token-export commands in shell history or persistent shell initialization files. 7. Document token rotation and immediate revocation procedures for suspected exposure. 8. Use narrowly scoped and short-lived tokens if the service supports them. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description uses mandatory-trigger wording for a broad set of user requests involving TikTok/Douyin links, replication, script extraction, and audio extraction, but it does not define exclusions or require confirmation before invoking tool-driven actions. This can cause over-activation, leading the agent to process third-party content or initiate external operations in contexts where the user intent is ambiguous or where policy, copyright, or privacy concerns should first be checked.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The trigger examples show when to activate the skill, but they do not describe when not to activate it or impose limits on handling adjacent requests. In practice, this weak boundary-setting increases the chance of the skill being invoked for loosely related prompts, causing unnecessary tool use and potential mishandling of copyrighted or third-party media.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to install software, download binaries, modify PATH, and potentially use package mirrors, while explicitly encouraging environment bootstrapping instead of failing safely when dependencies are missing. These are real system-modifying actions with supply-chain and persistence implications, and the lack of an upfront warning/consent gate increases the risk of unauthorized changes on the host environment.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill supports extracting audio from third-party video links and presents it as a normal workflow, but it gives only a limited downstream copyright note and no meaningful upfront warning about rights, consent, or privacy. That makes misuse easier in cases involving copyrighted media, non-public content, or content the requester is not authorized to process.

Static analysis

No suspicious patterns detected.