ClawHub
Back to skill

Security audit

Ozon-中国专区产品榜 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a coherent Ozon product-ranking lookup, but its setup instructions can install and update local tooling and persist API configuration beyond a single query.

Install only if you are comfortable letting the agent set up qhkit/Node and store or change qhkit credentials on this machine. Prefer installing reviewed, pinned tool versions yourself first, and provide credentials through your normal secret-management flow rather than letting the skill rewrite existing qhkit configuration.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该描述在列出两个示例触发语后，又使用“或提出同类需求时必须触发”进行开放式扩展，但没有说明哪些表达属于“同类需求”、哪些不属于。这会让技能在与 Ozon、中国卖家或爆款相关的泛化对话中被过度触发。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This query-focused skill includes broad environment-bootstrapping instructions to install Node.js and npm packages, greatly expanding its operational scope beyond data retrieval. That gives the skill software-management capability and can cause the agent to fetch and install executable code from external sources, increasing supply-chain and host-compromise risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill recommends executing npx @iqinghu/qhkit without pinning a specific package version. That allows whatever version is current at execution time to run, which weakens supply-chain integrity and can introduce unexpected or malicious behavior if the package or dependency chain changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

This duplicated finding points to the same persistence behavior: installing binaries into a user-controlled directory and altering execution paths. Such instructions create durable environmental changes and expand the blast radius of a skill that should only perform a bounded data query.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

This duplicated finding points to the same persistence behavior: installing binaries into a user-controlled directory and altering execution paths. Such instructions create durable environmental changes and expand the blast radius of a skill that should only perform a bounded data query.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to run qhkit config set --token <密钥> --env prod and to modify environment-variable-based authentication state. Persistently changing credentials and runtime configuration exceeds the stated purpose of querying product rankings and risks credential misuse, cross-session contamination, or overwriting existing user settings.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

文档的触发说明仅列出两条示例，但没有说明是否必须包含“Ozon”“中国专区”“销量/销售额排行”等关键限定词，也没有列出不应触发的相近场景。对于清单型技能，这种说明不足容易造成误判调用。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.