linkpix-grok-clone

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install Node.js directly from nodejs.org. It includes a verification step using sha256sum to ensure file integrity.
  • [EXTERNAL_DOWNLOADS]: The skill installs the @iqinghu/qhkit package (a resource owned by the vendor autoagc/iqinghu.com) from the npm registry, with fallback options for well-known mirrors such as Alibaba's npmmirror.com. It also mentions installing the pillow Python package via the well-known Tsinghua University mirror.
  • [COMMAND_EXECUTION]: The skill utilizes several CLI tools including npm, npx, curl, tar, and python to set up the environment and perform image processing tasks.
  • [DYNAMIC_EXECUTION]: The skill suggests using a Python one-liner or npx sharp-cli to programmatically resize images that exceed the 10MB limit. These scripts are predefined and used for specific utility tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided URLs from social media platforms to extract video scripts which are then processed by the AI.
  • Ingestion points: The resourceUrl parameter in the qhkit video-inspire generate call within SKILL.md accepts external links.
  • Boundary markers: The instructions require the agent to present both the original and rewritten scripts to the user for confirmation before proceeding to video generation, serving as a human-in-the-loop checkpoint.
  • Capability inventory: The skill uses qhkit for video analysis and generation, and uses shell commands for environment setup and image processing.
  • Sanitization: The skill specifies that resourceUrl only accepts http(s) links and involves an AI-driven rewriting process which acts as a filter for the raw data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 03:00 AM