Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised Bilibili creator-video lookup, but it also authorizes installing or updating CLI software, Node, and local token configuration, so users should review it before installing.
Install only if you are comfortable with the agent setting up qhkit/Node and configuring a Qinghu API token on your machine. Prefer reviewing or performing the setup yourself, pinning package versions where possible, and confirming paid qhkit calls before allowing data retrieval.
The manifest says the skill must trigger not only for two example phrases, but also for unspecified 'similar requests'. That creates an ambiguous activation boundary and can cause unintended invocation for loosely related requests about Bilibili creators or video stats.
The skill goes far beyond its declared purpose of querying Bilibili creator videos by directing the agent to install Node, install packages globally, configure tokens, and modify the runtime environment. This expands the attack surface substantially and can lead to unreviewed software execution, credential handling, and host modification in response to a simple data-query request.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to be fetched and run. In a skill context, this creates a supply-chain and reproducibility risk because future package changes or a compromised upstream release could alter behavior unexpectedly.
This duplicate finding points to the same persistence behavior: installing binaries under the home directory and changing PATH for future command execution. In context, the persistence is more dangerous because the skill's advertised function is only a narrow data lookup, yet it authorizes durable system modification unrelated to that business purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: installing binaries under the home directory and changing PATH for future command execution. In context, the persistence is more dangerous because the skill's advertised function is only a narrow data lookup, yet it authorizes durable system modification unrelated to that business purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The file instructs the agent to require the domestic CN site and to avoid international-site guidance unless the user clearly says they use AutoAGC. This imposes a locale/site constraint by default rather than offering the user a choice or making the constraint explicit up front as an opt-in.
No suspicious patterns detected.