qinghu-image-watermark-remove
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries from the official Node.js website and the Alibaba Cloud mirror (npmmirror.com). These are well-known and trusted services for development environments.
- [COMMAND_EXECUTION]: The skill executes the qhkit CLI tool, which is the core functionality provided by the vendor. It also uses standard shell commands for environment configuration.
- [REMOTE_CODE_EXECUTION]: Automated scans flagged a download from nodejs.org as potential remote code execution. However, the analysis shows the download is for a standard Node.js binary used in setup, and the instructions include mandatory SHA256 checksum verification before use, which is a security best practice.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image paths and processing modes. It uses a structured JSON file (@params.json) to pass these parameters to the CLI tool, minimizing the risk of command injection through malicious file naming or parameter input.
Audit Metadata