linkpix-media-tools
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads Node.js binaries and checksum files from the official nodejs.org domain. The instructions include a checksum verification step using sha256sum to ensure the integrity of the binary before extraction and use.
- [EXTERNAL_DOWNLOADS]: Installs the @iqinghu/qhkit npm package from the official registry or a well-known mirror (npmmirror.com) to provide the core functionality of the skill.
- [COMMAND_EXECUTION]: Executes the qhkit CLI tool to perform video and image processing tasks such as removing watermarks, subtitles, and upscaling video based on user instructions.
- [PERSISTENCE]: Recommends adding the local Node.js binary directory to the PATH environment variable in ~/.bashrc, which is a standard and safe practice for ensuring tool availability across shell sessions.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external media URLs or local file paths. 1) Ingestion points: media URLs and file paths in the qhkit generate commands. 2) Boundary markers: Absent. 3) Capability inventory: qhkit CLI performs network operations and file processing. 4) Sanitization: The skill relies on the underlying CLI tool to process media data, presenting minimal risk as it does not interpret the content as executable instructions.
Audit Metadata