Google-关键词趋势 | 青虎AI

• Outcome: Review
• Latest audit: Oct 16, 2026 · 4:12 AM UTC
• Version: 0.1.1

Overview

The skill appears to perform the advertised Google Trends lookup, but it also tells the agent to install or upgrade local tooling and alter qhkit account configuration.

Install only if you are comfortable letting the skill use the qhkit service, spend qinghu credits after approval, and potentially install or upgrade Node/qhkit and change qhkit account configuration. Prefer reviewing setup commands first and providing credentials through a secure secret mechanism rather than pasting tokens into the agent chat.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L003 列出若干示例触发语后，又补充“或提出同类需求时必须触发”，这会把触发范围扩展到不明确的相似表达，容易与普通讨论搜索热度、产品需求判断等日常表述重叠。文件虽有示例，但没有给出排除条件或负例来限定何种“同类需求”不应触发。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill goes far beyond a narrow Google Trends lookup and instructs the agent to install Node.js, install global packages, upgrade software, and modify the local environment. In an agent context, this materially expands attack surface and can lead to unauthorized software installation or system changes unrelated to the user’s core request.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution dependent on whatever package version is current at runtime. That creates supply-chain and reproducibility risk: a future compromised or breaking release could be fetched and executed in the host environment during skill use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This duplicated persistence finding reflects the same behavior: unpacking software into a user-controlled directory and exporting a modified execution path. In an agent execution environment, that creates durable environmental drift and can be leveraged by later commands, making the skill materially more dangerous than its declared business purpose suggests.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This duplicated persistence finding reflects the same behavior: unpacking software into a user-controlled directory and exporting a modified execution path. In an agent execution environment, that creates durable environmental drift and can be leveraged by later commands, making the skill materially more dangerous than its declared business purpose suggests.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs reading and modifying local credential/config state via qhkit config show and qhkit config set, as well as manipulating environment variables. In a hosted agent environment, this can expose sensitive configuration details, overwrite existing credentials, or coerce the agent into handling secrets and account state beyond the stated keyword-trend task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

L112 明确规定 site 必须是 cn，并要求“不要按国际站引导用户取密钥，也不要拿国际站的模型清单答复”，只有用户明确说明使用国际版账号时才保留 intl。这属于预设区域/站点限制，而非默认提供用户选择，可能构成未获用户主动选择的 locale/区域策略强制。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.