Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly aimed at fetching Baidu hot-search data, but it also tells the agent to install and upgrade runtime software and persist service credentials for a paid external CLI.
Review this before installing if you are not comfortable with a skill that may install Node/qhkit, update packages, and store a Qinghu API token locally. Prefer using it only in a controlled environment with qhkit already installed, confirm paid calls before use, and avoid letting it modify shell startup files unless you explicitly want persistent setup.
The trigger language says the skill must fire for undefined 'similar requests', making invocation boundaries ambiguous and overly broad. Overbroad activation is dangerous here because the skill can lead to package installation, credential setup, and paid external calls, so accidental triggering has real security and cost consequences.
For a skill whose purpose is only to fetch Baidu hot-search rankings, directing the agent to install Node.js, globally install a CLI, and upgrade software materially expands the agent's authority and attack surface. This turns a simple data-retrieval skill into a general software installation workflow, enabling unnecessary code execution and persistent host modification.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows execution of whatever package version is current at invocation time. That creates supply-chain and reproducibility risk, especially because the package is then used to access external services and process credentials.
This duplicated finding points to the same persistence behavior: installing Node.js under the user's home directory and exporting a modified PATH. Even though the example notes shell-scoped behavior, the documented flow explicitly encourages reusable local installation and optional shell-profile persistence, which is disproportionate to the skill's stated purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: installing Node.js under the user's home directory and exporting a modified PATH. Even though the example notes shell-scoped behavior, the documented flow explicitly encourages reusable local installation and optional shell-profile persistence, which is disproportionate to the skill's stated purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill tells the agent to configure persistent credentials via qhkit config set or environment variables, which exceeds the minimal privileges needed for a one-off hot-search lookup. Persisting secrets and modifying account configuration creates long-lived access that can be reused outside the immediate task and increases the risk of credential exposure or cross-session misuse.
The trigger example '今天大家都在搜什么' is a natural conversational phrase that could refer to general curiosity about public interest, not specifically Baidu hot rankings. Without nearby constraints or negative examples, it risks accidental activation in contexts unrelated to this skill.
No suspicious patterns detected.