linkpix-model-face-swap
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from nodejs.org, which is a well-known technology provider.
- [REMOTE_CODE_EXECUTION]: The skill includes procedures for downloading and installing Node.js. It mitigates risk by instructing the user/agent to verify the binary's integrity using
sha256sumagainst an official SHASUMS256.txt file before execution or extraction. - [COMMAND_EXECUTION]: The skill executes the
qhkitCLI tool and standard package managers likenpm. It references the official npm registry and a well-known mirror (npmmirror.com) for package installation. - [PERSISTENCE]: The setup instructions include an option to append a PATH modification to the
~/.bashrcfile to ensure the installed Node.js environment persists across shell sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as image paths, video URLs, and descriptive prompts. While this creates an attack surface where malicious instructions could be embedded in processed data, the skill recommends using structured JSON files (
@params.json) for tool arguments to reduce shell-level injection risks.
Audit Metadata