qinghu-model-photo-realistic
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries from the official Node.js distribution server (
nodejs.org) and its recognized mirror (npmmirror.com). These are well-known, trusted sources. - [EXTERNAL_DOWNLOADS]: It installs the
@iqinghu/qhkitpackage from the official npm registry. This package is the primary tool required for the skill's functionality and is owned by the skill's vendor (iqinghu.com). - [COMMAND_EXECUTION]: The skill utilizes standard system utilities including
curl,tar, andsha256sum. Specifically, it usessha256sumto verify the integrity of downloaded binaries before installation, which is a recommended security practice. - [COMMAND_EXECUTION]: Automated scan results regarding remote code execution were evaluated and determined to be false positives. The detected pattern is an integrity check for a downloaded file, not a direct piping of remote code into a shell for execution.
Audit Metadata