qinghu-ad-film

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of Node.js binaries directly from the official Node.js distribution server (nodejs.org). It also provides commands to install the @iqinghu/qhkit package from the standard NPM registry.
  • [PERSISTENCE]: The installation instructions suggest appending a PATH environment variable configuration to the user's shell profile (~/.bashrc) to ensure that the manually installed Node.js binary remains available in future sessions.
  • [COMMAND_EXECUTION]: The skill instructs the user to perform global package installations via npm install -g and utilizes tar to extract downloaded binaries. These are standard procedures for setting up a CLI-based development environment.
  • [CREDENTIALS_UNSAFE]: The skill provides instructions for the user to obtain an API token from the vendor's dashboard (iqinghu.com) and configure it using the CLI's configuration command or an environment variable.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images and text prompts as inputs for the video generation tool, representing a data ingestion surface.
  • Ingestion points: Local image files and text prompts are passed as arguments to the qhkit video generate command.
  • Boundary markers: No specific boundary markers or instruction-isolation delimiters are implemented in the command templates.
  • Capability inventory: The skill utilizes shell execution for qhkit, npm, curl, sha256sum, and tar operations.
  • Sanitization: The skill does not explicitly describe sanitization logic for input image metadata or prompt text.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:09 PM