爆款女装视频模仿 | 女装带货 | 虚拟模特 | 动作复刻 | LinkPix

• Outcome: Pass
• Latest audit: Sep 8, 2026 · 4:32 AM UTC
• Version: 0.1.6

Overview

This skill is a disclosed Qinghu/QHKit workflow for generating women's apparel promo videos, with some dependency-installation and billing risks users should approve explicitly.

Install only if you are comfortable sending the selected media to Qinghu, using a Qinghu API token, and potentially spending credits after the estimate. Prefer a pinned or isolated qhkit installation, review the credit estimate before generation, and use only media you own or are authorized to process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75
• Finding: Unpinned npm Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6, 75-80, and 100-104 **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"👗","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The documented fallback executes the package through `npx`: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade procedure explicitly retrieves the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning an exact reviewed version or enforcing a package integrity value. The `@latest` upgrade procedure intentionally resolves to mutable package contents, meaning the executable code used by the Skill can change after this Skill has been audited. Both global npm installation and `npx` may execute package lifecycle scripts and package binaries with the privileges of the invoking user. The optional use of another npm registry also expands the number of infrastructure components that must be trusted. The package is relevant to the declared workflow, so requiring a CLI dependency is not inherently excessive. However, globally installing an unpinned executable package exceeds the minimum-risk approach because a project-local, exact-version installation would provide the required functionality with less system-wide exposure. ### Attack Path A feasible supply-chain exploitation path is: 1. An attacker compromises the npm publisher account, a dependency, a registry response, or a future package release. 2. The compromised release is assigned the version selected by the unpinned installation or the `latest` tag. 3. The user or agent follows the Skill instructions and runs the global npm installation, upgrade command, or `npx` fallback. 4. npm downloads the compromised packag ...[truncated 1150 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an unconstrained package name or `@latest`. 2. Record and verify package integrity using a lockfile or an expected npm integrity hash. 3. Prefer a project-local or isolated installation over global installation. 4. Avoid `npx` with an unpinned package because it can download and immediately execute a release that was not reviewed. 5. Require explicit user approval before installing or upgrading executable dependencies. 6. Remove automatic upgrade guidance based only on stderr notifications. Review and pin each new release before deployment. 7. Where compatible, install with lifecycle scripts disabled and explicitly enable only scripts demonstrated to be required. 8. Document the exact trusted registry and avoid silently switching registries. If a mirror is necessary, apply the same integrity verification as for the primary registry. 9. Run the CLI under an account with access only to the media required for the current workflow and store API tokens with restrictive file permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:85
• Finding: Predictable Shared Temporary Archive Creates a Verification-to-Extraction Race<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 85-89 **Vulnerability Type**: Unsafe temporary-file handling and time-of-check/time-of-use race **Risk Level**: Medium ### Vulnerable Code ```bash # Linux binary installation (installed in the user directory without root; verify the official SHA256 before extraction): cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH" ``` ### Technical Analysis The Node.js archive is downloaded to a predictable filename in the shared `/tmp` directory. Checksum verification and archive extraction are then performed as separate operations. Although the checksum verification protects against a corrupted or remotely modified download at verification time, it does not bind the verified file to the file later opened by `tar`. On a multi-user or otherwise hostile system, another local process may attempt to replace or redirect the predictable path after `sha256sum` completes but before `tar` opens it. Existing files or symbolic links at that location also create unsafe path-handling conditions. The flagged pipeline is not a `curl | bash` execution pattern. It sends a checksum manifest through an exact filename filter to `sha256sum -c`; downloaded manifest text is not interpreted as shell code. The weakness is instead the use of a shared predictable path and the gap between verification and extraction. ### Attack Path A local exploitation path is: 1. An attacker has access to another account or process on the same host and can monitor the shared `/tmp` directory. 2. The legitimate Node.js archive is downloaded to the predictable `/tmp/node-v22.22.3-linux-x64.tar.xz` path. 3. The archiv ...[truncated 1412 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory using `mktemp -d` and ensure it is accessible only to the current user: ```bash set -euo pipefail tmp_dir="$(mktemp -d)" chmod 700 "$tmp_dir" trap 'rm -rf "$tmp_dir"' EXIT ``` 2. Download both the archive and checksum manifest into that private directory. 3. Use explicit output paths rather than relying on `curl -O` and the current working directory. 4. Verify the exact archive inside the private directory and stop immediately if any pipeline component fails. 5. Extract only after successful verification, without exposing the archive in a shared writable directory. 6. Validate archive entries before extraction and reject unexpected absolute paths, parent-directory traversal, symbolic links, or unexpected top-level directories. 7. Remove the temporary directory after installation, including on failure. 8. Avoid overwriting an existing installation without explicit user confirmation. 9. Confirm that the extracted `node` and `npm` binaries reside under the expected installation directory before prepending it to `PATH`. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to bootstrap its environment by downloading and installing Node.js and a global npm package from the network, which exceeds the narrow purpose of transforming user-provided media. This expands the attack surface to supply-chain compromise, unsafe package execution, and environment modification on the host, especially because the instructions explicitly say not to give up when dependencies are missing.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The top-level description says the skill 'must trigger' for broad commerce/media requests such as changing models or making women's apparel promo videos. This can cause the agent to invoke a networked, billable media-generation workflow in situations where the user intent is ambiguous, increasing the risk of unintended actions, charges, or handling of unauthorized third-party content.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The example triggers are short, everyday phrases like '做一条女装带货视频' and '女模特换一下', which are too ambiguous for an auto-invocable skill tied to external uploads, billing, and long-running jobs. In context, this makes accidental invocation more dangerous because the workflow processes media, may require credentials, and can incur paid usage.

Static analysis

No suspicious patterns detected.