Security audit
Security checks for vulnerabilities and agentic risk
The skill does the Ozon product lookup it advertises, but its setup instructions can persistently change the user environment and configure a service token through unpinned external tooling.
Install only if you are comfortable using Qinghu/qhkit for paid Ozon data, storing or providing a Qinghu API token, and allowing local Node/npm/qhkit setup. Prefer a preinstalled, reviewed, pinned qhkit version and avoid letting the skill modify shell startup files unless you explicitly want that.
The manifest description says the skill 'must trigger' when users say two example phrases 'or make similar requests', which leaves the activation boundary ambiguous. This can overlap with ordinary discussion of competitors or product research and may cause unintended invocation because no exclusions or negative examples are provided.
The '何时触发' section gives two concise phrases, including the very general '关键词下的竞品', but does not state when the skill should not activate. Without constraints tying the trigger to Ozon keyword-related-product queries or required identifiers, the trigger language is too vague for reliable activation.
The skill’s stated purpose is querying Ozon keyword-related products, but it also contains extensive instructions to install Node, install a CLI globally, download binaries, set tokens, and modify environment state. This broadens the trust boundary substantially: a simple data-query skill becomes an environment-bootstrap and software-installation workflow, increasing the chance of unsafe changes, token exposure, or execution of unreviewed tooling.
The skill instructs use of npx @iqinghu/qhkit without pinning a version, which makes execution dependent on whatever package version is current at run time. That increases supply-chain risk and can unexpectedly introduce changed behavior or malicious code if the upstream package or dependency chain is compromised.
This duplicated finding identifies the same persistent installation behavior: unpacking software into the user home directory and altering executable search paths. In the context of an agent skill, that exceeds least privilege and creates lasting system changes unrelated to a one-off product query.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding identifies the same persistent installation behavior: unpacking software into the user home directory and altering executable search paths. In the context of an agent skill, that exceeds least privilege and creates lasting system changes unrelated to a one-off product query.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions require guiding users only through the domestic Chinese site and explicitly say not to use the international site unless the user clearly states they do. This imposes a locale/site constraint by default rather than offering a user choice or opt-in, which is a natural-language policy concern under language/locale requirements.
No suspicious patterns detected.