linkpix-tiktok-shop-image
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and associated checksum files from official sources (nodejs.org) or well-known mirrors (npmmirror.com) to bootstrap the environment.
- [COMMAND_EXECUTION]: Shell commands are used to install the
@iqinghu/qhkitpackage, verify file integrity viasha256sum, and process images using Python (Pillow) or Node.js (sharp-cli) if local files exceed size limits. - [PERSISTENCE]: The instructions direct the agent to modify the user's shell profile (
~/.bashrc) to persist thePATHenvironment variable for Node.js binaries across sessions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided images and text strings which are passed to external CLI tools and AIGC models. While this represents a vulnerability surface for indirect injection, the skill provides specific instructions for JSON parameters and utilizes vendor-controlled processing tools.
Audit Metadata