linkpix-sales-video
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
qhkitcommand-line tool from the official NPM registry and Node.js binaries from officialnodejs.orgdistribution servers. It also provides a fallback to the well-knownnpmmirror.comregistry (maintained by Alibaba) for users with restricted network access. - [COMMAND_EXECUTION]: Executes shell commands to install and configure the environment, including
npm,curl,tar, andsha256sumfor binary management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data, such as images and video files, as input for the video generation process. This represents an attack surface for indirect prompt injection, but the risk is managed by the skill's intended purpose of processing these files via a specific CLI tool.
- [REMOTE_CODE_EXECUTION]: An automated scanner flagged a shell pipe as a potential remote code execution risk. Upon review, this is a false positive; the command
curl ... | grep ... | sha256sum -c -is used to verify the integrity of the Node.js binary before installation, which is a recommended security procedure.
Audit Metadata