Security audit

1688选品专家 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent 1688 sourcing helper that uses a disclosed external API, with some install-time guidance needed around broad activation, stored API tokens, and automatic file export.

Install only if you intend to use Qinghu/1688 sourcing workflows. Expect outbound API requests, possible Qinghu credit usage after your approval, and local spreadsheet exports for larger result sets. Use a dedicated API key if possible and avoid sharing sensitive product research in environments where exported files may be retained unexpectedly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger description uses mandatory language such as '必须触发' for a wide set of common sourcing terms, which can cause the skill to activate in situations where the user did not intend to invoke an external paid/data-accessing workflow. In this skill’s context, over-triggering is more dangerous because invocation can lead to token use, external requests, and possible charges once the agent proceeds.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The example phrases include broad everyday requests like '找货源 / 找供应商', which overlap with ordinary conversation and may spuriously route users into this skill. Because the skill is tied to external API usage and billing guidance, false activation can expose users to unnecessary token handling, data transfer, or cost-related prompts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to read credentials from environment variables like QINGHU_TOKEN and QHKIT_TOKEN without pairing that behavior with a visible privacy and consent warning. In context, this is sensitive because environment-sourced secrets are privileged host data, and the skill normalizes their use in a user-invocable workflow that also makes outbound network requests.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs automatic export of result sets of 10 or more records and references cached local file paths, but it does not warn that files will be created, stored, or potentially retained on disk. In this context, the exported data may include supplier and product datasets, so silent file creation increases privacy, retention, and unintended disclosure risk.

Static analysis

No suspicious patterns detected.