Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent ad-asset generator, but it asks agents to install and upgrade third-party tooling and persist API credentials on the host without clear user confirmation or containment.
Review before installing. This skill appears purpose-aligned, but it can install or update Node/npm tooling, run an unpinned qhkit package, and store a qhkit API token on the machine. Prefer a preinstalled, version-pinned qhkit in a disposable or managed environment, provide tokens through scoped secret handling where possible, and confirm before allowing global installs, upgrades, or shell-profile changes.
The trigger language says the skill must activate for broad, common e-commerce content requests, which can cause unintended invocation. Over-broad mandatory triggering is dangerous because it may route benign content tasks into a skill that performs installation, configuration, network access, and third-party service interaction the user did not specifically request.
This skill includes extensive environment bootstrap and software installation steps unrelated to the narrow task of generating ad assets, including installing Node, globally installing packages, and upgrading tooling. Expanding agent behavior from content generation into host modification increases attack surface, enables arbitrary third-party code execution, and violates least-privilege expectations for a user-invocable skill.
The skill instructs use of npx @iqinghu/qhkit without a pinned version, allowing whatever package version is current at execution time to be fetched and run. That creates a supply-chain risk and makes behavior non-reproducible; if the upstream package is compromised or changes unexpectedly, the agent could execute unreviewed code.
This duplicated finding identifies the same persistence behavior: unpacking Node into a user-controlled directory and exporting a modified PATH. In the context of a user-invocable marketing asset skill, durable environment changes are unjustified and widen the blast radius of any compromised dependency or mistaken invocation.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding identifies the same persistence behavior: unpacking Node into a user-controlled directory and exporting a modified PATH. In the context of a user-invocable marketing asset skill, durable environment changes are unjustified and widen the blast radius of any compromised dependency or mistaken invocation.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs the agent to set persistent authentication credentials via qhkit config set or environment variables, causing secrets to be stored or modified on the host. This can leak credentials across sessions, affect other workflows, and normalize an agent handling long-lived tokens for a third-party service without clear isolation or consent.
The instructions require using the domestic iqinghu.com site, require site to be cn, and direct the agent not to use the international configuration unless the user explicitly states they use it. This imposes a locale-specific policy by default rather than offering the user a language/region choice.
No suspicious patterns detected.