抖音-话题下视频 | 青虎AI

• Outcome: Review
• Latest audit: Oct 16, 2026 · 4:12 AM UTC
• Version: 0.1.1

Overview

This skill is a legitimate Douyin hashtag-video query helper, but it also tells the agent to install tooling, modify the local environment, and persist an API token, so users should review it before installing.

Install only if you are comfortable letting the agent install or upgrade qhkit/Node tooling and configure a Qinghu API token on this machine. Prefer a controlled environment with preinstalled, pinned qhkit, and avoid storing tokens persistently unless that matches your security expectations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L003 写明“当用户说……或提出同类需求时必须触发”，其中“同类需求”没有边界、约束或反例，属于模糊激活条件。虽然给了两个示例短语，但未说明哪些近似表达不应触发，容易与一般性抖音分析请求重叠。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill goes far beyond querying hashtag videos by instructing the agent to install Node.js, install a CLI globally, download binaries, and modify the execution environment. That expands the skill from narrow data retrieval into host-environment provisioning, increasing attack surface and enabling unintended code execution paths on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill recommends using npx @iqinghu/qhkit without pinning an exact package version, which allows whatever version is current at execution time to be fetched and run. In a security-sensitive agent context, this creates a supply-chain risk and undermines reproducibility, especially because the skill also encourages bootstrapping missing tooling automatically.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding points to the same persistent host modification behavior: unpacking binaries into a user directory and exporting a modified PATH. Such session-to-session environment mutation is dangerous because it changes future execution semantics outside the immediate hashtag-query task and can be abused if the installed toolchain is later invoked implicitly.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding points to the same persistent host modification behavior: unpacking binaries into a user directory and exporting a modified PATH. Such session-to-session environment mutation is dangerous because it changes future execution semantics outside the immediate hashtag-query task and can be abused if the installed toolchain is later invoked implicitly.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs the agent to set persistent credentials via qhkit config set --token or environment variables in the host environment. This is dangerous because it pushes the agent into account and secret-management behavior outside the stated task, risks credential persistence beyond the session, and may alter unrelated workflows on the machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L015-L018 的触发说明只有“这个话题下有哪些视频”“话题里的爆款”两个示例，没有说明是否要求抖音语境、是否必须是话题维度、以及哪些相似说法不应调用本技能。对 markdown 技能说明而言，这种触发定义仍然偏宽泛。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

L101 明确要求“本技能对接国内版 iqinghu.com”，并指示在检测到 intl 配置时覆盖为国内站，只有用户明确说明使用国际版账号时才保留。这对地区/站点进行了默认强制，而不是先提供用户选择或明确征得同意。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.