linkpix-ad-film
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from official sources (https://nodejs.org). It also fetches the @iqinghu/qhkit package from the official npm registry. These downloads are part of the standard environment bootstrap process and use trusted repositories.
- Evidence includes the use of
curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xzfor runtime installation. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage environment setup (e.g., extracting tarballs, setting path variables) and to execute the qhkit CLI tool for video generation. Automated scan alerts regarding piped execution were evaluated as false positives, as the pipes are used for cryptographic hash verification (
sha256sum -c -) rather than direct command execution of remote content. - [PERSISTENCE]: The instructions suggest appending the Node.js installation path to the shell profile (
~/.bashrc). This is a legitimate and transparent configuration step intended to keep the required runtime environment accessible across different sessions for the agent's operations.
Audit Metadata