linkpix-video-upscale

Fail

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: HIGHPERSISTENCEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The skill instructs the agent to modify the user's shell configuration file (~/.bashrc) to add the Node.js binary path to the system PATH. This allows the environment configuration to persist across different shell sessions.
  • [PRIVILEGE_ESCALATION]: The instructions suggest that the agent should attempt to escalate privileges if global package installation via npm fails due to permissions, which typically involves administrative commands like sudo.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Node.js runtime from nodejs.org and the qhkit package from the NPM registry. These resources are retrieved from well-known and reputable services.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external video URLs and tool outputs. Ingestion points: The urls parameter in the video_super_resolve action accepts arbitrary local paths or public URLs. Boundary markers: No explicit delimiters or warnings to ignore instructions embedded within processed data are present. Capability inventory: The skill executes shell commands (qhkit, npm, curl, tar), writes to files, and performs network requests. Sanitization: No specific sanitization or validation of the input URLs or tool outputs is described.
Recommendations
  • HIGH: Downloads and executes remote code from: https://nodejs.org/dist/v22.22.3/SHASUMS256.txt - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 21, 2026, 04:10 PM