Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly aligned with paid Douyin hashtag lookup, but it also tells agents to bootstrap host software and credentials with limited user-control guardrails.
Review before installing. This skill can be useful for paid Douyin hashtag data, but only allow setup if you are comfortable installing Node/npm tooling, configuring a Qinghu API token, and letting the agent spend Qinghu credits after approval. Prefer preinstalled, pinned qhkit versions and confirm before changing site or token configuration.
The metadata says the skill 'must trigger' for broad phrases like '话题数据', which can cause the agent to invoke this skill in cases where the user's intent is ambiguous or broader than Douyin hashtag lookup. Over-broad mandatory invocation increases the chance of unnecessary external calls, billing, and data handling outside the user's actual request.
The activation examples include a generic trigger such as '话题数据' without clear constraints tying it to Douyin hashtag detail queries. In context, that can misroute unrelated requests into this skill and drive external tool use or paid calls without sufficient disambiguation.
For a skill whose stated purpose is only querying hashtag details, the documentation goes far beyond scoped use and directs the agent to install software, configure tokens, modify PATH, and bootstrap runtime dependencies on the host. This expands the trust boundary significantly and can lead to unnecessary host modification, credential handling, and execution of downloaded code unrelated to the user's immediate request.
The skill presents installation, upgrade, and configuration commands that modify the local environment, but it does not lead with a clear warning that these actions change the host and may download and execute code. In an agent setting, this can normalize risky environment modification for a simple data-query task and reduce the chance of informed user consent.
The skill instructs using npx @iqinghu/qhkit without pinning an exact version, which makes execution dependent on whatever package version is current at runtime. That creates a supply-chain risk: behavior can change unexpectedly or a compromised package release could be fetched and executed in the host environment.
This duplicated finding points to the same persistent installation behavior: extracting Node.js into a user-writable location and updating PATH. The persistence is risky in context because it changes the host state for a paid third-party data lookup workflow and enables future command execution via newly installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistent installation behavior: extracting Node.js into a user-writable location and updating PATH. The persistence is risky in context because it changes the host state for a paid third-party data lookup workflow and enables future command execution via newly installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This line instructs the agent to require site be cn and to override intl configuration unless the user explicitly states they use the international account. That is a locale/region policy constraint imposed by default without first offering the user a choice or clearly limiting the skill to a region-specific audience in the activation/description.
No suspicious patterns detected.