Security audit
Security checks for vulnerabilities and agentic risk
This Ozon keyword-ranking skill is mostly coherent, but it asks the agent to install and upgrade external tooling, modify the user environment, and configure an API token without clear user-controlled setup boundaries.
Install only if you are comfortable letting the agent set up qhkit/Node tooling, store or use a Qinghu API token, and make paid Qinghu API calls after approval. Prefer preinstalling a reviewed, pinned qhkit version yourself and providing the token through a controlled environment variable rather than allowing automatic global installs or shell-profile changes.
The trigger description is overly broad and says the skill 'must' activate for similar needs, which can cause the agent to invoke it outside a tightly scoped intent. Overbroad activation increases the chance of unnecessary paid calls, unintended data access, or tool use in contexts where the user did not clearly request this specific capability.
The activation examples are short and ambiguous, lacking negative examples or required qualifiers such as explicit Ozon context, ranking intent, or data-query intent. In an agent environment, ambiguous triggers can lead to accidental invocation, but this is primarily a scoping and safety-control weakness rather than direct exploitation.
The skill goes far beyond data-query instructions by telling the agent to bootstrap Node.js, install global packages, configure tokens, and modify the environment. For a keyword-ranking skill, these are powerful system-changing actions that expand the attack surface and could lead to unreviewed software installation, credential handling, and persistence on the host.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows retrieval of whatever package version is current at execution time. In a tool-executing agent context, this creates a supply-chain risk and makes behavior non-reproducible, especially because the package is then trusted to access external services and handle credentials.
This duplicated finding reflects the same risk: the skill directs the agent to unpack software into a user-controlled directory and export a modified PATH. Even if intended as convenience, that creates session-to-session persistence and increases the blast radius well beyond the skill's legitimate purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding reflects the same risk: the skill directs the agent to unpack software into a user-controlled directory and export a modified PATH. Even if intended as convenience, that creates session-to-session persistence and increases the blast radius well beyond the skill's legitimate purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions say to send the user the domestic-site credential guidance text directly and repeatedly frame responses around Chinese-site wording, without offering a language choice. This is a natural-language locale constraint that appears mandatory rather than optional or user-selected.
No suspicious patterns detected.