Security audit
Security checks for vulnerabilities and agentic risk
The skill is narrowly aimed at Ozon keyword lookup, but it also tells the agent to install and update local runtime tooling and configure credentials during normal use.
Install only if you are comfortable letting this skill install or update Node/qhkit tooling and store Qinghu API configuration on the machine. Prefer preinstalling a reviewed, pinned qhkit version yourself, then use the skill only after confirming paid credit usage and the correct Qinghu account region.
The manifest says the skill must trigger when the user gives the listed examples "or提出同类需求时必须触发", which broadens activation beyond explicit phrases. Without scope limits or negative examples, this creates ambiguity about what counts as a similar request and increases the chance of unintended invocation.
The "何时触发" section lists only two example utterances, including a very general phrase like "这个词怎么样", but does not define required constraints such as needing Ozon keyword-detail intent, keyword IDs, or exclusion cases. This ambiguity makes activation criteria unclear and may overlap with ordinary analysis requests.
The skill claims to perform a narrow Ozon keyword query, but it also directs host-level bootstrap steps including installing Node, installing npm packages, setting config, and modifying environment state. This violates least privilege and expands the attack surface far beyond the business function of reading keyword metrics.
These instructions authorize host-level software installation and configuration changes that are not justified by the narrow query purpose of the skill. Even if intended for usability, such behavior enables arbitrary code introduction, configuration drift, and persistence on the host system.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which can fetch and execute whatever package version is current at runtime. In a skill whose stated purpose is keyword-detail lookup, this creates unnecessary supply-chain risk and makes behavior non-reproducible across sessions.
This duplicated finding identifies the same persistence behavior: unpacking a runtime into the user's home directory and altering PATH. Such host-state changes outlive the task and are disproportionate to the skill's narrowly stated purpose, making the context more dangerous rather than less.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding identifies the same persistence behavior: unpacking a runtime into the user's home directory and altering PATH. Such host-state changes outlive the task and are disproportionate to the skill's narrowly stated purpose, making the context more dangerous rather than less.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The file states the skill "对接国内版 iqinghu.com" and instructs agents to directly send domestic-site key guidance and not use international-site responses unless the user explicitly says they use the international account. This imposes a locale/site preference by default rather than offering the user a choice, which is a natural-language policy concern.
No suspicious patterns detected.