Security audit
Security checks for vulnerabilities and agentic risk
The skill’s review-query purpose is coherent, but it asks agents to install software, modify local environment state, and configure API credentials with limited user-control boundaries.
Install only if you are comfortable letting the agent set up qhkit/Node tooling and configure a Qinghu API token locally. Prefer doing dependency and token setup yourself first, avoid unpinned npx/@latest execution in sensitive environments, and approve paid review calls only after checking the estimated Qinghu credit cost.
The invocation text says the skill 'must trigger' when users say phrases like '看看这个 ASIN 的差评', '拉一下 1 星 2 星评论', '用户都在吐槽什么' or '提出同类需求时'. The catch-all wording '同类需求' is ambiguous and the listed phrases are broad enough to overlap with ordinary discussion about reviews, with no exclusion conditions or boundary examples.
This section lists only a few example utterances, without specifying whether an ASIN is required, whether the request must be explicitly about Amazon review retrieval, or when the skill should not be used. That lack of scope boundaries makes activation ambiguous for a manifest/markdown trigger description.
The skill’s stated purpose is Amazon review retrieval, but it includes broad environment-bootstrap steps that install Node.js, install npm packages, and modify execution environment state. This materially expands the agent’s privileges and attack surface from data retrieval into software installation and system modification, which is dangerous if the skill is auto-invoked or used in sensitive hosts.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution dependent on whatever package version is current at invocation time. That creates supply-chain and reproducibility risk: a compromised, breaking, or behavior-changing upstream release could be pulled and executed automatically in the agent environment.
This duplicate finding points to the same persistence behavior: unpacking software into a user-controlled directory and directing PATH changes that can survive beyond the task when copied into shell startup files. Persistent environment mutation increases blast radius if the installed package is later abused or if the skill is triggered unintentionally.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking software into a user-controlled directory and directing PATH changes that can survive beyond the task when copied into shell startup files. Persistent environment mutation increases blast radius if the installed package is later abused or if the skill is triggered unintentionally.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to set API credentials in local config or environment variables, including overwriting configuration and guiding users to obtain tokens. Credential configuration is broader than review lookup and can lead to persistent secret handling, accidental exposure, or unauthorized account binding in the host environment.
No suspicious patterns detected.