Security audit
Security checks for vulnerabilities and agentic risk
This 1688 product lookup skill is not deceptive, but it asks the agent to modify the host environment and configure API credentials, so it should be reviewed before use.
Install only if you trust the Qinghu qhkit package and want this agent to use your Qinghu account for paid 1688 data lookups. Prefer a platform-managed or pinned qhkit installation, approve any Node/npm setup before it runs, and use a scoped token rather than letting the skill freely change existing qhkit configuration.
The manifest says the skill '必须触发' not only for three example phrases but also whenever the user '提出同类需求', which leaves the activation boundary unclear. This can overlap with ordinary requests about product information and may cause unintended invocation because no exclusion conditions or negative examples are provided.
This skill goes beyond invoking a narrow product-detail lookup and contains extensive environment bootstrap logic, including installing Node, installing packages globally, modifying PATH, and upgrading tooling. In an agent context, such host modification substantially expands the attack surface and can lead to arbitrary software installation or persistence unrelated to the user's immediate request.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on the latest package resolution at runtime. This creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed in the host environment during skill use.
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and exporting a modified PATH. In context, the skill is for querying product metadata, so persistent runtime installation is disproportionate and increases long-term host exposure.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and exporting a modified PATH. In context, the skill is for querying product metadata, so persistent runtime installation is disproportionate and increases long-term host exposure.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs the agent to inspect host configuration and set API credentials via commands and environment variables (qhkit config show, config set --token, QHKIT_TOKEN). Accessing and modifying host credentials is sensitive behavior unrelated to simply extracting an offer_id and querying product details, and could expose secrets or alter account context.
The '何时触发' section provides short natural-language examples like '看看这个 1688 商品的详情' and '这个 offer 的价格和销量' but does not clearly define when the skill should not activate. In particular, '这个 offer 的价格和销量' is underspecified outside context and could collide with general conversation unless bounded to 1688 offer_id or 1688 links.
No suspicious patterns detected.