Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly aligned with its stated Ozon keyword-query purpose, but it also tells the agent to change the user's local tool environment and credentials with limited user control.
Review before installing if you do not want skills to install or reconfigure local Node/qhkit tooling. Use a preinstalled, pinned qhkit version where possible, confirm paid calls explicitly, and avoid sharing or storing a Qinghu token unless you trust the qhkit package and account configuration flow.
The activation text says the skill 'must trigger' for similar needs without defining boundaries, which can cause overbroad invocation on loosely related requests. In a skill that can initiate paid external calls and environment setup, ambiguous triggering increases the likelihood of unintended tool use, unnecessary credential prompts, or accidental charges.
The trigger section provides only a couple of examples and lacks exclusions or strict scope constraints, leaving too much room for subjective matching. Because this skill can drive paid queries and system-setup behavior, underspecified activation materially raises the risk of misuse or accidental execution beyond user intent.
The skill goes far beyond its stated purpose by directing installation of Node/qhkit, modification of PATH, fetching binaries from the network, and configuration of API credentials in the host environment. This expands the attack surface from a simple data query into host bootstrapping and secret handling, increasing the chance of persistence, misconfiguration, credential exposure, or execution of untrusted software.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact package version, which allows execution of whatever version is current at invocation time. That creates supply-chain risk and undermines reproducibility for a skill that is supposed to perform a narrowly scoped product-keyword query.
This is a duplicate manifestation of the same persistence issue: the documented setup installs software under the user home directory and changes command resolution. Such host-state modification is unnecessary for a simple Ozon keyword query and increases the risk of persistence, interference with other tools, and future unintended execution of the installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This is a duplicate manifestation of the same persistence issue: the documented setup installs software under the user home directory and changes command resolution. Such host-state modification is unnecessary for a simple Ozon keyword query and increases the risk of persistence, interference with other tools, and future unintended execution of the installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs inspecting existing qhkit configuration and potentially overriding site/environment settings, including guidance around environment variables and token sources. Reading and changing ambient configuration unrelated to the user’s immediate request can disrupt other workloads, alter trust boundaries, and steer the agent into manipulating broader host state.
No suspicious patterns detected.