qinghu-image-text-edit
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download Node.js binaries and associated SHA256 checksums from the official nodejs.org website. It also references registry.npmmirror.com, which is a well-known service (Alibaba Cloud NPM mirror).
- [COMMAND_EXECUTION]: The skill executes local commands to set up the environment, including the use of sha256sum to verify the integrity of the Node.js package before extraction. This is a recognized safety practice to prevent the execution of corrupted or malicious binaries.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of local image files and user-defined prompts. It manages this risk by using structured JSON arguments when calling the qhkit CLI and providing rigid prompt templates for the agent to follow.
- [PERSISTENCE]: The setup instructions include adding the custom Node.js installation path to the user's shell profile (~/.bashrc), which is a standard method for maintaining environment configuration across sessions.
Audit Metadata