qinghu-video-upscale-hd
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from the official nodejs.org distribution server and its recognized Alibaba mirror (npmmirror.com), both of which are well-known and reputable sources.
- [REMOTE_CODE_EXECUTION]: The skill installs the vendor's CLI tool, @iqinghu/qhkit, via npm or npx. A significant security best practice is employed by piping the download into sha256sum to verify the file integrity before extraction, effectively preventing the execution of corrupted or malicious binaries.
- [PERSISTENCE]: The instructions suggest adding a path export to the user's shell profile (~/.bashrc) to ensure the Node.js installation remains available across sessions, which is standard configuration for development tools.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for potential injection as it processes user-provided file paths and parameters for CLI commands. Ingestion points: Video file paths and workflow identifiers defined in SKILL.md. Boundary markers: The skill explicitly recommends using @params.json files for command arguments, which isolates user data from the shell environment. Capability inventory: Executes video processing workflows via the qhkit CLI. Sanitization: Enforces the use of structured JSON for command-line inputs to prevent shell metacharacter exploitation.
Audit Metadata