qinghu-video-ad-assets
Fail
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: HIGHPERSISTENCEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill instructions include a step to append a PATH export command to the ~/.bashrc file, which ensures that the Node.js and qhkit binaries remain executable in future shell sessions.- [REMOTE_CODE_EXECUTION]: The skill facilitates the download, verification, and execution of Node.js binaries from nodejs.org and the installation of the @iqinghu/qhkit package from the npm registry for runtime execution.- [COMMAND_EXECUTION]: The skill relies on several shell commands, such as curl for downloading resources, tar for extracting binaries, npm for package management, and qhkit for the primary task of video generation.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and local image file paths as input for the qhkit tool, creating a surface for potential injection attacks through untrusted data ingestion.- [EXTERNAL_DOWNLOADS]: The skill fetches software and integrity verification files from external sources including nodejs.org, npmjs.com, and the npmmirror.com registry.
Recommendations
- HIGH: Downloads and executes remote code from: https://nodejs.org/dist/v22.22.3/SHASUMS256.txt - DO NOT USE without thorough review
Audit Metadata