Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Ozon trend-query helper, but it also tells the agent to install and upgrade host tooling and alter qhkit authentication/site configuration with limited user-control language.
Review this skill before installing if you do not want an agent to install Node/qhkit, run npm or npx, modify PATH, or change qhkit token/site settings. Prefer a preinstalled, pinned qhkit version and provide credentials through a controlled secret path; approve paid qhkit calls only after checking the estimate.
The trigger criteria are broad natural-language phrases that can overlap with ordinary conversation, which raises the risk of unintended invocation. In this skill, accidental triggering is more concerning because invocation can lead to paid API use and host-side setup instructions rather than a harmless read-only lookup.
The skill claims to perform a narrow data-query task, but also includes extensive host bootstrapping, package installation, PATH changes, and credential setup guidance. This expands the skill's operational scope far beyond its declared purpose, increasing the chance that invoking the skill leads to host modification and execution of untrusted setup steps.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific package version, which makes execution depend on whatever version is current at runtime. That creates a supply-chain and reproducibility risk: a malicious or broken upstream release could change behavior or execute unexpected code on the host.
These sections instruct the agent/user to install Node, download binaries, modify PATH, and globally install packages on the host, none of which are necessary to describe a category-trend query interface. Host software installation and persistent environment modification materially increase attack surface and can be abused to introduce unauthorized code or alter future execution behavior.
This duplicated finding points to the same persistence behavior: unpacking software into the user's home directory and exporting a new binary path for subsequent use. Such modifications outlive the immediate task and broaden the blast radius if the installed tooling is compromised or misused later.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: unpacking software into the user's home directory and exporting a new binary path for subsequent use. Such modifications outlive the immediate task and broaden the blast radius if the installed tooling is compromised or misused later.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
L109 明确要求 site 必须是 cn，并指示“不要按国际站引导用户取密钥”，只有在用户“明确说自己用的是国际版”时才保留 intl。这种默认强制 locale/站点 的做法没有先给用户选择，也未在技能开头声明该技能仅面向中国站用户，存在语言/区域策略约束的自然语言政策问题。
The skill directs reading and changing qhkit authentication/configuration state, including setting tokens and environment selection. Accessing and mutating auth state exceeds the narrow business purpose of querying trends and can affect other sessions, accounts, or tools on the host.
No suspicious patterns detected.