qinghu-detail-page
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions include steps to download Node.js binaries from the official nodejs.org domain and verify them using sha256sum. While this involves downloading and extracting executable binaries, the use of a well-known official source and integrity verification is consistent with standard development practices.
- [EXTERNAL_DOWNLOADS]: The skill installs the @iqinghu/qhkit package from the NPM registry. It also provides an option to use a well-known mirror (npmmirror.com) if the primary registry is unavailable. These are standard package management operations for the tool's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image paths and text labels (e.g., customCopy) as inputs for the qhkit CLI. The instructions explicitly recommend using a JSON parameter file (@params.json) to handle these inputs, which is a recognized security measure to prevent shell command injection during interpolation.
- [PERSISTENCE]: The installation guide suggests appending the local Node.js binary path to the user's ~/.bashrc file. This is a routine method for maintaining environment variables across shell sessions for software installed in user-local directories.
Audit Metadata