Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its audio-extraction purpose, but it asks users to provide and store a service API key and sends video links through a third-party tool without enough privacy guidance.
Review this before installing if you are not comfortable giving the agent a qhkit API key or sending platform share links to qhkit. Prefer configuring the token locally yourself, avoid pasting secrets into chat, and revoke the key if it is exposed or no longer needed.
The skill metadata says requests to extract audio/BGM 'must trigger', using broad mandatory activation language tied to common user intents. This can cause over-invocation on ambiguous requests, leading the agent to perform external-link processing or tool use without sufficient confirmation, which increases privacy and safety risk.
The skill instructs the operator to have the user create and send an API key and to process third-party share links, but it provides no warning about secret handling, data exposure, or trust boundaries. Asking users to transmit tokens in chat is dangerous because credentials may be logged, retained, or misused, and submitted links may expose private or copyrighted content to external services.
The instructions state '本技能对接国内版' and explicitly say not to guide users to the international site, forcing a specific locale/service variant. This is a language/locale policy concern because the skill does not offer the user a choice or document a justified region-specific constraint.
