Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Ozon ranking-data tool, but it asks the agent to install and update host software and configure API credentials with broad, persistent setup steps.
Review the install steps before using this skill. Prefer a preinstalled or pinned qhkit version, avoid automatic global installs or shell startup changes unless you trust the package source, and only provide a Qinghu token and approve paid calls when you intend to spend Qinghu credits.
The description says requests with similar intent 'must trigger', using broad keyword-style matching without tight scope limits. Overbroad invocation increases the chance the skill is selected in unrelated contexts, which is more dangerous here because the skill contains instructions to install software and configure external tooling.
The skill goes beyond querying category-ranking data and instructs the agent to install Node.js, globally install a CLI, set configuration, and modify the execution environment. These are system-modifying actions that materially expand the blast radius from a simple data lookup to arbitrary software installation and credential handling on the host.
The skill directs the agent to run npx @iqinghu/qhkit without pinning an exact version, which allows retrieval of whatever package version is current at execution time. That creates a supply-chain risk and makes behavior non-deterministic, especially because the skill also encourages installation and execution in the host environment.
This duplicate finding points to the same persistence behavior: unpacking software into a user-controlled long-lived directory and altering PATH for reuse. In the context of a marketplace ranking skill, this is unnecessary privilege expansion and increases the chance of unintended future execution of unreviewed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking software into a user-controlled long-lived directory and altering PATH for reuse. In the context of a marketplace ranking skill, this is unnecessary privilege expansion and increases the chance of unintended future execution of unreviewed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The '何时触发' section lists only two short example utterances and does not clarify when similar requests should not activate the skill. Without exclusions or scope boundaries, nearby intents like broader market analysis or unrelated bestseller questions may collide with this skill.
No suspicious patterns detected.