Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Bilibili video-metrics helper, but it tells agents to install or upgrade host tools and configure a paid-service token with limited user gating.
Install only if you are comfortable letting the agent install or upgrade qhkit/Node and configure a Qinghu API token on your machine. Prefer a preinstalled, pinned qhkit version managed by you or an administrator, and approve any paid qhkit calls and local credential changes explicitly.
The manifest says the skill '必须触发' when the user says two example phrases '或提出同类需求时', but it does not define what counts as a similar request or provide exclusions. This can cause unintended invocation for loosely related everyday requests about Bilibili videos.
The stated purpose is querying Bilibili video metrics, but the skill also directs host bootstrapping: installing Node.js, globally installing/upgrading tooling, changing PATH, and setting credentials. Expanding from data retrieval into host software installation significantly increases attack surface and can lead to unintended code execution or system modification beyond the user’s likely expectations.
The skill contains software installation and environment-configuration behavior not strictly necessary for its narrow business function. Unnecessary capability expansion is dangerous because it gives a simple content-query skill the ability to alter the host environment, persist tools, and modify execution context, which is disproportionate to the task.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain and reproducibility risk: a future compromised or incompatible release could be fetched and executed on the host during normal skill use.
This duplicate persistence pattern again shows the skill directing host-level installation into the user directory and environment modification. Such persistence is unnecessary for a one-purpose lookup skill and increases the chance of unintended long-term changes, tool shadowing, or abuse of subsequently trusted binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate persistence pattern again shows the skill directing host-level installation into the user directory and environment modification. Such persistence is unnecessary for a one-purpose lookup skill and increases the chance of unintended long-term changes, tool shadowing, or abuse of subsequently trusted binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The '何时触发' section gives only two positive examples and no negative examples or explicit constraints on scope. Without clearer boundaries, agents may over-trigger on broadly similar Bilibili-related queries.
The markdown explains that large results are returned via a local file path and that data may be delivered as a table file, but it does not warn users up front that using the skill can create local files on the system. File creation affects user data and system state and should be disclosed in the skill description.
No suspicious patterns detected.