qinghu-promo-poster
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Node.js binary from the official nodejs.org distribution site and the qhkit package from the npm registry. It also identifies official mirrors such as npmmirror.com for reliability.
- [COMMAND_EXECUTION]: Employs standard system utilities including curl, tar, and npm to configure the execution environment. It executes the qhkit CLI tool to perform its primary function of image generation.
- [REMOTE_CODE_EXECUTION]: Downloads and runs external binaries for Node.js and the qhkit utility. The skill demonstrates high security awareness by explicitly requiring a SHA256 checksum verification (
sha256sum -c) of the downloaded Node.js archive before extraction and execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided product images and promotional text strings. While this provides a surface for potential prompt injection, the risk is inherent to the image generation task and the skill includes instructions for the agent to prompt the user to verify the final output for accuracy.
Audit Metadata