linkpix-grok-clone
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install Node.js directly from
nodejs.org. It includes a verification step usingsha256sumto ensure file integrity. - [EXTERNAL_DOWNLOADS]: The skill installs the
@iqinghu/qhkitpackage (a resource owned by the vendor autoagc/iqinghu.com) from the npm registry, with fallback options for well-known mirrors such as Alibaba'snpmmirror.com. It also mentions installing thepillowPython package via the well-known Tsinghua University mirror. - [COMMAND_EXECUTION]: The skill utilizes several CLI tools including
npm,npx,curl,tar, andpythonto set up the environment and perform image processing tasks. - [DYNAMIC_EXECUTION]: The skill suggests using a Python one-liner or
npx sharp-clito programmatically resize images that exceed the 10MB limit. These scripts are predefined and used for specific utility tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided URLs from social media platforms to extract video scripts which are then processed by the AI.
- Ingestion points: The
resourceUrlparameter in theqhkit video-inspire generatecall withinSKILL.mdaccepts external links. - Boundary markers: The instructions require the agent to present both the original and rewritten scripts to the user for confirmation before proceeding to video generation, serving as a human-in-the-loop checkpoint.
- Capability inventory: The skill uses
qhkitfor video analysis and generation, and uses shell commands for environment setup and image processing. - Sanitization: The skill specifies that
resourceUrlonly accepts http(s) links and involves an AI-driven rewriting process which acts as a filter for the raw data.
Audit Metadata