Security audit
Security checks for vulnerabilities and agentic risk
The skill’s Ozon trend-query purpose is coherent, but it asks agents to install and update runtime software, configure tokens, and alter local environment settings in ways that deserve review before installation.
Install only if you trust the qhkit package and are comfortable letting the agent set up Node/npm tooling and qhkit credentials. Prefer using an isolated environment with qhkit preinstalled and confirm before any install, upgrade, token overwrite, site change, or paid API call.
The manifest description says the skill 'must trigger' for requests like 'Ozon 最近大盘怎么样' and especially '整体销售趋势', plus 'similar needs'. '整体销售趋势' and '同类需求' are underspecified and could overlap with many broader analytics requests not limited to Ozon market-trend snapshots.
The activation guidance lists just two short example utterances, including the broad phrase '整体销售趋势', without stating when the skill should not activate. This leaves unclear whether the skill applies to seller-specific, category-specific, or other platform trend questions.
This market-trend skill goes beyond its stated read-only business purpose by instructing the agent to install Node, install packages globally, configure tokens, and alter the runtime environment. Expanding scope from data retrieval to environment bootstrapping increases the attack surface significantly and can lead to unreviewed software installation, credential handling, and system modification in the host context.
The skill recommends invoking npx @iqinghu/qhkit without pinning an exact version, which makes execution dependent on whatever package version is current at runtime. That creates supply-chain and reproducibility risk: a future compromised or breaking release could be fetched and executed in the agent environment during a query workflow.
This duplicate finding identifies the same environment-persistence behavior: extracting Node into a user directory and prepending it to PATH. Even with checksum verification, the skill is still directing persistent host alteration for a simple data-query task, which materially increases security risk and exceeds least-privilege expectations.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same environment-persistence behavior: extracting Node into a user directory and prepending it to PATH. Even with checksum verification, the skill is still directing persistent host alteration for a simple data-query task, which materially increases security risk and exceeds least-privilege expectations.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill hardcodes a default preference for the domestic site/configuration and instructs the agent to steer credential guidance accordingly. That kind of policy steering around account/site selection can cause credentials to be configured into the wrong environment, encourage override of existing configuration, and reduce user control over where secrets are sent.
No suspicious patterns detected.