qinghu-model-outfit-swap
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from
nodejs.org. This is a well-known service and the skill includes an explicit verification step usingsha256sumto ensure the downloaded file has not been tampered with. - [COMMAND_EXECUTION]: Executes the
qhkitcommand to perform image generation tasks. The setup instructions include extracting archives and managing environment variables, which are standard operations for tool installation. - [PERSISTENCE]: Instructs the user on how to persist
PATHchanges in~/.bashrc. This is a routine configuration step for ensuring development tools remain accessible across shell sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided image paths and textual prompts. While this represents a standard injection surface for LLM-integrated tools, it does not exhibit specific vulnerabilities beyond the inherent risks of processing natural language inputs.
Audit Metadata