Security audit
Security checks for vulnerabilities and agentic risk
The skill is clearly for Amazon keyword research, but it also tells the agent to install and update external tools, alter the user environment, and store an API token with limited user-control safeguards.
Review before installing if you do not want a skill to install or update npm packages, download Node, change PATH, or configure a qhkit API token. If installed, approve paid qhkit calls only after seeing the estimated credits, and prefer a preinstalled, pinned qhkit version in a controlled environment.
The trigger description uses broad mandatory language such as '必须触发' for loosely related requests, which can cause the skill to activate in contexts the user did not explicitly intend. Over-broad activation is dangerous because it can push the agent into paid external tool usage, environment changes, or data handling without sufficiently specific user consent.
The markdown trigger section gives example phrases but lacks clear boundaries and exclusions, so the agent may infer activation from partial similarity rather than explicit intent. In this skill, that matters because invocation can cascade into external CLI use and billed API calls.
The skill goes beyond keyword mining and directs the agent to install software, modify the environment, and configure API credentials. That materially increases the attack surface: it can lead to arbitrary code execution through package installation, persistent environment changes, and credential handling in a workflow that should only invoke an existing tool.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to be fetched and run. In a skill context, this creates a supply-chain and reproducibility risk because behavior can change unexpectedly or a compromised upstream release could execute arbitrary code.
This duplicate finding points to the same persistence behavior: unpacking binaries into a user directory and exporting a modified PATH for future command resolution. Even though the text frames it as convenience setup, in practice it normalizes stateful system modification from a skill that should only perform keyword-mining operations.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking binaries into a user directory and exporting a modified PATH for future command resolution. Even though the text frames it as convenience setup, in practice it normalizes stateful system modification from a skill that should only perform keyword-mining operations.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
These lines instruct the agent to send a specific Chinese guidance message to the user about obtaining keys and handling site configuration. This imposes a language choice in the skill behavior without offering the user a language option or documenting that the skill is Chinese-only.
No suspicious patterns detected.