Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Ozon product-data lookup that uses a paid qhkit API/CLI, with setup and credential handling that users should review before use.
Install only if you are comfortable using the qhkit npm package, configuring a Qinghu token, and spending Qinghu credits after approval. Prefer a preinstalled or pinned qhkit version when possible, and review any proposed Node/npm setup before allowing it.
The metadata says the skill 'must trigger' for broadly similar requests, which can cause over-invocation on ambiguous prompts. In context, this is risky because invocation can lead to paid tool usage and local setup actions, so an overly broad trigger increases the chance of unintended execution.
The phrase '这个商品卖了多少' is broad natural language that could occur in many contexts and does not itself constrain platform, data source, or required product-ID lookup. The trigger section provides no negative examples or guardrails to distinguish intended Ozon-specific use from general discussion.
For a product-detail lookup skill, the documentation goes far beyond minimal execution and instructs installing Node, globally installing packages, setting tokens, modifying PATH, and changing persistent local configuration. This expands the attack surface significantly and could lead an agent to make unnecessary system changes or handle secrets on the user's machine for a simple data query.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates supply-chain and reproducibility risk: a later compromised or incompatible release could be fetched and executed in the user's environment.
This duplicate finding identifies the same persistent installation behavior: writing binaries under the user's home directory and altering PATH. Such actions exceed the least-privilege needs of the stated skill and can leave long-lived modifications that survive the immediate task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same persistent installation behavior: writing binaries under the user's home directory and altering PATH. Such actions exceed the least-privilege needs of the stated skill and can leave long-lived modifications that survive the immediate task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions mandate use of the domestic iqinghu.com site and explicitly tell the agent not to guide users toward the international site unless the user clearly states that preference. This imposes a locale/site choice by default without offering the user a language or locale option.
No suspicious patterns detected.