linkpix-marketing-assets
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries from the official Node.js website and the
@iqinghu/qhkitpackage from the npm registry or its well-known Alibaba mirror (npmmirror.com). - [PERSISTENCE]: The instructions include a step to append the Node.js binary directory to the user's
~/.bashrcfile (追加进 ~/.bashrc) to ensure environment variables persist across shell sessions. - [COMMAND_EXECUTION]: The skill executes several shell commands for installation and verification, such as
curl,tar, andsha256sum. Notably, it follows security best practices by verifying the SHA256 checksum of the Node.js archive before extraction to ensure file integrity.
Recommendations
- HIGH: Downloads and executes remote code from: https://nodejs.org/dist/v22.22.3/SHASUMS256.txt - DO NOT USE without thorough review
Audit Metadata