qinghu-ad-film
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of Node.js binaries directly from the official Node.js distribution server (
nodejs.org). It also provides commands to install the@iqinghu/qhkitpackage from the standard NPM registry. - [PERSISTENCE]: The installation instructions suggest appending a PATH environment variable configuration to the user's shell profile (
~/.bashrc) to ensure that the manually installed Node.js binary remains available in future sessions. - [COMMAND_EXECUTION]: The skill instructs the user to perform global package installations via
npm install -gand utilizestarto extract downloaded binaries. These are standard procedures for setting up a CLI-based development environment. - [CREDENTIALS_UNSAFE]: The skill provides instructions for the user to obtain an API token from the vendor's dashboard (
iqinghu.com) and configure it using the CLI's configuration command or an environment variable. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images and text prompts as inputs for the video generation tool, representing a data ingestion surface.
- Ingestion points: Local image files and text prompts are passed as arguments to the
qhkit video generatecommand. - Boundary markers: No specific boundary markers or instruction-isolation delimiters are implemented in the command templates.
- Capability inventory: The skill utilizes shell execution for
qhkit,npm,curl,sha256sum, andtaroperations. - Sanitization: The skill does not explicitly describe sanitization logic for input image metadata or prompt text.
Audit Metadata