linkpix-promo-poster
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads official Node.js binaries from nodejs.org and the qhkit package from the npm registry. These are well-known and reputable services for development tools.
- [COMMAND_EXECUTION]: The skill uses shell commands to install the necessary CLI tools and generate images. It follows security best practices by performing a checksum verification (
sha256sum -c) on downloaded binaries before execution or extraction. - [PERSISTENCE]: The skill suggests appending the Node.js binary path to the user's
~/.bashrcfile. This is a standard procedure for configuring the environment path and does not represent malicious behavior in this context. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text prompts to generate images via an external API. While this creates a boundary for external data, the skill utilizes a specific CLI tool (
qhkit) with expected network and file-reading capabilities for its primary purpose.
Audit Metadata