linkpix-storyboard
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Node.js binaries and the '@iqinghu/qhkit' package from well-known and official sources including nodejs.org, npmjs.com, and the Alibaba npmmirror.com registry.
- [REMOTE_CODE_EXECUTION]: Automated scans flagged a download pattern involving piped commands. Analysis confirms this is a security best practice for binary integrity verification, where the Node.js SHASUMS256 file is piped to grep and sha256sum to ensure the downloaded archive is authentic before being unpacked.
- [COMMAND_EXECUTION]: The skill operates by executing shell commands using the 'qhkit' tool. It includes instructions to mitigate command injection risks by recommending the use of JSON parameter files (@params.json) instead of direct shell string interpolation for user-provided data.
Audit Metadata