Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the stated Ozon category lookup, but it also tells the agent to install runtimes/packages and configure API tokens in ways users should review first.
Install only if you are comfortable with qhkit, Node/npm setup, and qinghu API token configuration on this machine. Prefer a preinstalled, pinned qhkit version, confirm before any global install or site overwrite, and avoid pasting long-lived tokens directly into shell commands when possible.
The manifest says the skill must trigger when the user says the listed phrases "or提出同类需求时必须触发", which broadens activation beyond the explicit examples. This leaves the invocation boundary unclear and can cause unintended triggering for loosely related requests.
The skill instructs the system to rely on local files for large results but does not warn that query outputs may be written to disk. Writing potentially sensitive business data to local storage without explicit notice or retention guidance can leak data through shared workspaces, backups, or later processes.
The skill goes far beyond a simple category-query capability by instructing the agent to install Node, install global packages, configure API tokens, and troubleshoot environment state. This materially expands the attack surface and grants the skill influence over host configuration, package installation, and credential handling that are unnecessary for a narrow data lookup task.
The skill recommends running npx @iqinghu/qhkit without pinning an exact version. That allows whatever package version is current at execution time to be fetched and run, increasing supply-chain risk and making behavior non-reproducible if a compromised or breaking release is published.
This duplicated finding reflects the same persistence issue: the skill instructs writing binaries under the user's home directory and modifying PATH for future use. Such host changes outlive the session and are disproportionate to the stated read/query capability, making the skill context more dangerous because a simple lookup tool should not self-bootstrap persistent runtimes.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding reflects the same persistence issue: the skill instructs writing binaries under the user's home directory and modifying PATH for future use. Such host changes outlive the session and are disproportionate to the stated read/query capability, making the skill context more dangerous because a simple lookup tool should not self-bootstrap persistent runtimes.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill tells users to set credentials via command line and environment variables without privacy or process-exposure warnings. Tokens entered on the command line may be captured in shell history or process listings, and long-lived environment variables can leak into subprocesses or logs.
The text mandates that site must be cn and instructs the agent to override international configuration unless the user explicitly says they use AutoAGC. This imposes a locale/site constraint by default rather than offering a neutral user choice up front.
No suspicious patterns detected.