qinghu-marketing-assets
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from nodejs.org, which is a well-known and trusted source for development runtimes. Use of these resources is documented neutrally as part of the environment setup.
- [REMOTE_CODE_EXECUTION]: The skill installs and executes the
@iqinghu/qhkitpackage from the official npm registry. This is a vendor-owned resource corresponding to the skill's owner (iqinghu.com) and represents standard functionality. - [COMMAND_EXECUTION]: The skill executes shell commands to perform asset generation. It includes security-conscious guidance, such as recommending the use of
@params.jsonto pass arguments, which prevents potential shell injection or escaping issues compared to raw string interpolation. - [PERSISTENCE]: The skill suggests appending a local installation path to
~/.bashrcto ensure the Node.js runtime remains available across sessions. This is a standard user configuration practice for non-root software installations. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts for generating image and video content. The risk is minimized by the skill's design, which uses structured JSON parameters and recommends file-based input to maintain clear boundaries between instructions and data.
Audit Metadata