Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Ozon category lookup tool, but it asks the agent to install and configure host-level tooling with persistent credentials and unpinned runtime dependencies.
Review this skill before installing if you do not want an agent to install Node/npm packages, alter PATH or shell profile behavior, or store a qhkit token on your machine. If you use it, prefer a preinstalled, pinned qhkit version in an isolated environment and confirm any paid qhkit call before it runs.
The manifest description says the skill 'must trigger' not only for two example phrases but also for '同类需求', which is ambiguous and expands activation beyond clearly defined requests. This can cause unintended invocation because it does not specify exclusion conditions or concrete limits for what counts as a similar request.
This skill goes far beyond querying category data by directing the agent to install Node.js, globally install a CLI, configure credentials, and modify the host environment. For a simple lookup skill, these instructions unnecessarily expand the trusted computing base and create opportunities for unauthorized software installation, persistence, credential handling, and supply-chain compromise.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain and reproducibility risk: a future compromised or breaking release could be fetched and executed in the host environment during skill use.
This duplicate finding points to the same persistence behavior: unpacking software into a user-controlled directory and altering PATH to make it executable in future shell contexts. In the context of a category-query skill, persisting tooling on the host is disproportionate and materially increases risk if the installed component or follow-on commands are compromised.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking software into a user-controlled directory and altering PATH to make it executable in future shell contexts. In the context of a category-query skill, persisting tooling on the host is disproportionate and materially increases risk if the installed component or follow-on commands are compromised.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
These lines instruct the agent to direct users to the domestic Chinese site and explicitly say not to guide users using the international site unless the user clearly states they use it. This imposes a locale/site policy by default rather than offering the user a choice, which can violate language or locale neutrality requirements.
No suspicious patterns detected.