linkpix-video-upscale
Fail
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: HIGHPERSISTENCEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill instructs the agent to modify the user's shell configuration file (
~/.bashrc) to add the Node.js binary path to the systemPATH. This allows the environment configuration to persist across different shell sessions. - [PRIVILEGE_ESCALATION]: The instructions suggest that the agent should attempt to escalate privileges if global package installation via
npmfails due to permissions, which typically involves administrative commands likesudo. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Node.js runtime from
nodejs.organd theqhkitpackage from the NPM registry. These resources are retrieved from well-known and reputable services. - [INDIRECT_PROMPT_INJECTION]: The skill processes external video URLs and tool outputs. Ingestion points: The
urlsparameter in thevideo_super_resolveaction accepts arbitrary local paths or public URLs. Boundary markers: No explicit delimiters or warnings to ignore instructions embedded within processed data are present. Capability inventory: The skill executes shell commands (qhkit,npm,curl,tar), writes to files, and performs network requests. Sanitization: No specific sanitization or validation of the input URLs or tool outputs is described.
Recommendations
- HIGH: Downloads and executes remote code from: https://nodejs.org/dist/v22.22.3/SHASUMS256.txt - DO NOT USE without thorough review
Audit Metadata