Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Bilibili comment-collection integration, but it tells the agent to make persistent host and credential configuration changes that users should review before installing.
Review this before installing if you do not want an agent to install Node/npm tooling, run unpinned npm packages, or persist a Qinghu API token in your local qhkit configuration. Use it only in an environment where qhkit setup and paid Qinghu calls are acceptable, and confirm account/site settings before giving a token.
The trigger phrase 评论区反馈 is broad enough to match ordinary conversation that may not clearly request execution of this paid external-data skill. In context, that can cause unintended activation, external requests, and possible charges or data disclosure without sufficiently specific user intent.
For a skill whose declared purpose is collecting Bilibili comments, the documentation instructs the agent to install Node, install global packages, modify PATH, and bootstrap runtime dependencies on the host. This unnecessarily expands the skill's privilege and attack surface, turning a simple data query into host-environment modification with persistent side effects.
The skill recommends executing npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to run in the host environment. That creates a supply-chain risk and undermines reproducibility, especially because the skill also encourages bootstrapping tools locally for a narrowly scoped data-collection task.
This is a duplicate detection of the same persistent-install behavior: unpacking software into a user directory and updating PATH. The underlying issue remains that the skill normalizes persistent host modification for a task that should only require a bounded external query.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This is a duplicate detection of the same persistent-install behavior: unpacking software into a user directory and updating PATH. The underlying issue remains that the skill normalizes persistent host modification for a task that should only require a bounded external query.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs setting persistent credentials via qhkit config set --token <密钥> --env prod or environment variables in the host environment. Persisting tokens for a single-purpose comment-collection skill increases the risk of credential leakage, reuse by unrelated processes, and long-lived access beyond the user's immediate intent.
The skill forces a specific site/locale configuration (site must be cn, overwrite intl settings, alter environment variables) without clear user opt-in. That can override existing account context, disrupt other tooling, and route credentials or requests in ways the user did not explicitly authorize.
No suspicious patterns detected.