亚马逊-类目市场统计 | 青虎AI

• Outcome: Review
• Latest audit: Oct 16, 2026 · 4:02 AM UTC
• Version: 0.1.1

Overview

This Amazon analytics skill appears legitimate, but it asks the agent to install or update local command-line tooling and alter account configuration, so users should review it before use.

Install only if you are comfortable with the agent using qhkit, accessing a Qinghu API token, and spending Qinghu credits after approval. Prefer preinstalling a vetted qhkit version and providing credentials through a secure secret flow instead of letting the skill install Node/npm packages or rewrite local qhkit configuration automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

该描述除了列举示例短语外，又用“同类需求”作兜底，未说明哪些近似表达应触发、哪些不应触发。对清单式触发条件来说，这种开放式表述会扩大匹配范围，增加非预期调用风险。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill goes far beyond category-statistics analysis by directing the agent to install Node.js, globally install packages, fetch binaries, modify PATH, and bootstrap runtime dependencies. That materially expands the attack surface and permits environment modification unrelated to the narrow user task, which is risky even if presented as convenience or resiliency guidance.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever the latest published package is at execution time to be fetched and run. In a skill context, that creates a supply-chain risk and undermines reproducibility, especially because the same document also encourages installation and execution of external tooling.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This duplicate finding reflects the same persistent-install behavior: unpacking software into the home directory and exporting a modified PATH. In the context of a skill that should only perform market-statistics queries, such stateful environment changes are unjustified and materially increase risk.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This duplicate finding reflects the same persistent-install behavior: unpacking software into the home directory and exporting a modified PATH. In the context of a skill that should only perform market-statistics queries, such stateful environment changes are unjustified and materially increase risk.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs inspecting and modifying credential/config state via qhkit config show and qhkit config set --token, and discusses environment variables containing secrets. This exceeds the analytics purpose and can expose sensitive configuration or lead the agent to alter authentication state, increasing the chance of credential mishandling or account crossover.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

文本要求“应先将关键词翻译为目标站点/国家对应语言”，属于对用户输入处理的固定语言策略。文件未提供用户可选择保留原语言、确认翻译结果或说明这是唯一受支持方式，因此构成潜在的语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.