qinghu-main-image-optimize
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download Node.js binaries from official distribution servers at nodejs.org or the Aliyun mirror (npmmirror.com) for environment setup. These downloads are performed using standard tools and include integrity verification via SHA256 checksums.
- [COMMAND_EXECUTION]: The skill utilizes the
qhkitcommand-line utility and thenpmpackage manager to install dependencies and execute image optimization tasks. These commands are restricted to the vendor's own tools and standard development utilities. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted user data.
- Ingestion points: Processes user-provided image paths and custom prompt strings within the
qhkit image generatecommand parameters in SKILL.md. - Boundary markers: Arguments are encapsulated within structured JSON strings to prevent simple command injection.
- Capability inventory: Performs subprocess execution of the
qhkitCLI and file system reads for image inputs. - Sanitization: Relies on the external CLI tool's internal validation for input processing.
Audit Metadata