Security audit
Security checks for vulnerabilities and agentic risk
The skill’s core hot-search lookup is coherent, but it tells agents to install tooling, fetch Node binaries, alter user configuration, and handle API tokens for a simple query.
Review before installing. The hot-search query itself is narrow, but allow this skill only if you are comfortable with qhkit setup, Node/npm installation, and Qinghu API token configuration on the machine. Prefer preinstalling and pinning trusted versions yourself, and do not let an agent change shell config or overwrite existing qhkit site/token settings without explicit approval.
The manifest says the skill must trigger for the listed examples or any 'similar requests', but it does not define what counts as similar versus out of scope. This ambiguity can cause unintended invocation for general B站 popularity or trend questions that may not specifically request the hot-search list.
The skill goes well beyond data retrieval and instructs the agent to install Node, install packages globally, set persistent configuration, and guide the user through token setup. That materially expands the attack surface from a simple read-only query into software installation and credential-handling operations on the host environment.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. In a skill context that can bootstrap missing dependencies automatically, this increases supply-chain risk and reduces reproducibility if a bad or incompatible release is published.
This duplicate finding identifies the same session-persistence behavior: unpacking executables under the user's home directory and altering the command search path. In context, that is disproportionate to the skill's stated purpose and increases risk of unintended long-lived changes or abuse if the instructions are followed automatically.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same session-persistence behavior: unpacking executables under the user's home directory and altering the command search path. In context, that is disproportionate to the skill's stated purpose and increases risk of unintended long-lived changes or abuse if the instructions are followed automatically.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
These instructions mandate domestic-site-specific handling and tell the agent to provide domestic key-acquisition guidance unless the user explicitly states they use the international account. The file does not offer an opt-in or language/locale choice, which can violate language/locale neutrality expectations.
The '何时触发' section lists two example utterances, but does not state whether they are exhaustive or what nearby requests should not trigger the skill. Without scope limits or non-examples, invocation behavior remains underspecified for similar everyday queries.
No suspicious patterns detected.