AI电商工作流应用 | 模特换脸 | 视频一键生成 | 青虎AI

• Outcome: Pass
• Latest audit: Sep 8, 2026 · 4:23 AM UTC
• Version: 0.1.5

Overview

This is a disclosed Qinghu workflow skill, but users should be careful with the third-party CLI, paid uploads, and API token handling.

Install only if you intend to use Qinghu's external workflow service. Prefer a reviewed/pinned qhkit version, avoid pasting API tokens directly into shell commands when safer secret storage is available, confirm credit estimates before generation, and upload only media you own or are authorized to process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81
• Finding: Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 81-86 **Vulnerability Type**: Supply-chain risk from unpinned npm package installation **Risk Level**: Medium ### Vulnerable Code ```bash # No qhkit but node/npm is available: install globally npm i -g @iqinghu/qhkit ``` The accompanying instructions also permit direct execution through an unpinned package: ```bash npx @iqinghu/qhkit <command> ... ``` A related upgrade instruction at lines 101-104 explicitly installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The installation and fallback commands do not pin `@iqinghu/qhkit` to a specific audited version or package integrity hash. Both the implicit latest version and the explicit `@latest` tag can change after this Skill has been reviewed. npm package installation may execute package lifecycle scripts, while subsequent invocation executes the installed package with the permissions of the current user. The global installation mode also places executable content in a shared user-level or system-level npm location rather than isolating it to the Skill's working directory. The documentation additionally permits use of `registry.npmmirror.com` as a fallback registry. Although this may be operationally useful, it introduces another supply-chain trust boundary. The audit did not find evidence that the named package or mirror is currently malicious; the vulnerability is the absence of version and integrity controls. ### Attack Path 1. An attacker compromises the package publisher account, package distribution channel, or an allowed registry. 2. The attacker publishes a malicious release under the package's current default or `latest` version. 3. The agent follows the Skill instructions and runs the unpinned global installation, `npx` fallback, or automatic upgrade. 4. npm lifecycle code or the subsequently invoked CLI executes with the instal ...[truncated 768 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, for example: ```bash npm install --save-exact @iqinghu/qhkit@0.10.0 ``` 2. Verify the selected package using an approved lockfile and npm integrity metadata. 3. Remove automatic `@latest` upgrades. Require explicit user approval and security review before changing versions. 4. Prefer a project-local installation over `npm i -g` to reduce installation scope. 5. If `npx` is retained, specify an exact version and prevent package substitution: ```bash npx --yes @iqinghu/qhkit@0.10.0 ... ``` 6. Use only explicitly approved registries and document the trust implications of any mirror. 7. Run the CLI under a restricted, non-administrative account with access limited to the files required for the requested workflow.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98
• Finding: API Token Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 98 **Vulnerability Type**: Sensitive credential passed as a process argument **Risk Level**: Medium ### Vulnerable Code ```bash qhkit config set --token <key> --env prod ``` The same instruction also proposes environment-variable or configuration-file alternatives: ```text QHKIT_TOKEN OPENCLAW_CONFIG_PATH ``` ### Technical Analysis Passing an API token directly as a command-line argument can disclose it outside the intended CLI. Depending on the operating environment, the complete command may be retained in shell history, agent execution transcripts, terminal logs, monitoring systems, audit records, or process metadata visible to other local users. Environment variables can also leak through process inspection, crash reports, or diagnostic output unless carefully controlled. A configuration file is safer only when it has restrictive permissions and the CLI reliably redacts secrets from output. No hardcoded credential was found in the Skill. The issue concerns the recommended credential-entry mechanism. ### Attack Path 1. A user supplies a valid Qinghu API token. 2. The agent or user runs the documented `qhkit config set --token ...` command. 3. The complete command is recorded in shell history, an agent transcript, process telemetry, or another logging facility. 4. Another local user, administrator, support operator, or log consumer retrieves the token. 5. The exposed token is used to authenticate to the Qinghu service and perform operations allowed by that credential. ### Impact Assessment Exposure can allow unauthorized use of the victim's Qinghu account within the token's granted permissions. Potential effects include submitting paid workflows, consuming credits, accessing account-related workflow data, and obtaining or manipulating service outputs available through the CLI. This finding does not provide operating-system privilege ...[truncated 108 chars]
• Remediation: ## Remediation Suggestions 1. Replace command-line token entry with a hidden interactive prompt or stdin-based secret input that does not echo or enter shell history. 2. Store credentials in an operating-system credential manager or secret-management service where supported. 3. If a configuration file is required, create it with owner-only permissions such as `0600`. 4. Avoid exposing the token through ordinary environment variables when stronger secret-injection mechanisms are available. 5. Ensure `qhkit config show`, errors, debug logs, and agent transcripts always redact credential values. 6. Document token revocation and rotation procedures for suspected exposure. 7. Scope tokens to the minimum service permissions and spending authority required for the workflow.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill metadata says it 'must trigger' whenever a user wants to use Qinghu AI apps or is uncertain which app to use, which is an overly broad routing rule for a user-invocable skill. This can cause the agent to invoke external tooling for vague or common requests without sufficient user confirmation, increasing the chance of unintended actions, cost-incurring operations, and data sharing with a third-party service.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example trigger phrases include broad requests like fixing an image, removing a watermark, generating an ad video, or tracking creator/video data, but they do not define boundaries or exclusions. In context, this makes the skill prone to over-capture ordinary user requests and route them into a third-party workflow, which may expose user files, trigger paid operations, or encourage policy-sensitive uses such as watermark removal without adequate checks.

Static analysis

No suspicious patterns detected.