Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Douyin play-count lookup skill using qhkit; its setup and token handling deserve care, but the artifact does not show hidden or incompatible behavior.
Install only if you are comfortable adding qhkit/Node tooling and storing a qhkit token for Qinghu services on this machine. Prefer a reviewed, pinned qhkit installation where possible, and verify any paid call before allowing it to run.
The instruction 提出同类需求时必须触发 is ambiguous and leaves trigger boundaries undefined. Ambiguity in auto-invocation logic is dangerous because it encourages over-triggering and makes it difficult to predict when external commands, paid APIs, or credentialed actions will be used.
The instruction 提出同类需求时必须触发 is ambiguous and leaves trigger boundaries undefined. Ambiguity in auto-invocation logic is dangerous because it encourages over-triggering and makes it difficult to predict when external commands, paid APIs, or credentialed actions will be used.
The skill's stated purpose is narrowly to query a Douyin video's play count, but the documentation expands into environment bootstrapping, package installation, Node installation, and credential setup. This broadens the action surface from a simple data lookup to host modification and secret handling, increasing the chance of unnecessary code execution and unsafe operator behavior.
The skill instructs installing software, modifying PATH, and changing the local environment even though the business function is only to check a play count. These instructions can cause unnecessary host changes and expand the blast radius if the package source, install command, or surrounding environment is compromised.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates supply-chain and reproducibility risk: a future compromised or incompatible release could be fetched and executed automatically.
This duplicated finding points to the same persistence behavior: extracting binaries into a user directory and altering PATH. Such host modification is disproportionate to the skill's purpose and can leave residual tooling available for unintended future use.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: extracting binaries into a user directory and altering PATH. Such host modification is disproportionate to the skill's purpose and can leave residual tooling available for unintended future use.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill tells the operator to place authentication secrets into local config or environment variables for a narrow analytics query. Handling secrets inside a skill that does not need to manage credentials directly increases the risk of token leakage, reuse across contexts, and accidental persistence on shared hosts.
The trigger examples include a vague standalone phrase without scope limitations or counterexamples. In isolation this is less severe than direct code execution issues, but it still increases the risk of accidental invocation and unnecessary external API usage.
No suspicious patterns detected.