linkpix-jd-image
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Node.js binaries and SHA256 checksums from the official
nodejs.orgdistribution site or thenpmmirror.comregistry during the environment bootstrap process. - [REMOTE_CODE_EXECUTION]: Downloads and extracts the Node.js runtime and installs the
@iqinghu/qhkitpackage from the NPM registry. The skill correctly implements security best practices by verifying the SHA256 hash of the downloaded Node.js archive before performing extraction. - [DYNAMIC_EXECUTION]: Generates and executes localized Python (using the Pillow library) or Node.js (using sharp-cli) code snippets to compress and resize user-provided images that exceed size limitations.
- [COMMAND_EXECUTION]: Orchestrates the generation of product images by executing the
qhkitCLI tool with parameters derived from user input. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied images and prompt text for image generation. While it uses JSON-structured arguments for CLI interaction, it does not utilize specific boundary markers or sanitization logic for the arbitrary text inputs passed to the underlying AIGC models.
Audit Metadata