Security audit
Security checks for vulnerabilities and agentic risk
The skill’s Amazon product-research purpose is clear, but it asks the agent to install or update unpinned command-line tools and persist API-token configuration, so it needs review before use.
Install only if you trust Qinghu AI/qhkit and are comfortable with a paid external data service. Prefer a controlled setup where qhkit and Node are preinstalled at reviewed versions, avoid automatic npx/latest upgrades, and decide explicitly how the QHKIT token should be stored before letting the skill run.
The manifest says the skill '必须触发' when the user says several example phrases '或提出同类需求时', but it does not clearly bound what counts as a similar request. Phrases like '帮我在美国站选品' and '扫一下这个类目的潜力款' are broad enough to overlap with ordinary product-research requests, increasing the risk of unintended invocation.
This section lists three example utterances but does not clarify when the skill should not activate, nor does it distinguish this skill from adjacent Amazon analysis tasks. Without negative examples or stricter constraints, the activation boundary remains ambiguous.
The skill contains extensive environment bootstrapping, software installation, and credential configuration steps that go well beyond product research. In an agent setting, these instructions can modify the host, install executables, and persist API tokens, expanding the attack surface and enabling unintended code execution or credential exposure.
The skill instructs the agent to execute an unpinned package via npx, which fetches the latest published package at runtime. That creates a supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could cause arbitrary code execution in the agent environment without prior review.
This duplicate finding points to the same persistence behavior: extracting Node into $HOME and exporting a modified PATH. Even though framed as convenience, it normalizes durable environment changes by the skill, which is unsafe in a least-privilege agent model.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: extracting Node into $HOME and exporting a modified PATH. Even though framed as convenience, it normalizes durable environment changes by the skill, which is unsafe in a least-privilege agent model.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
No suspicious patterns detected.