Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to do the Ozon product-ranking job it advertises, but it also tells the agent to install software and configure credentials on the user's machine without enough upfront control.
Install only if you are comfortable with Qinghu qhkit making external paid API calls and with the agent potentially installing Node/qhkit and configuring a local API token. Prefer using an isolated environment, preinstall a pinned qhkit version yourself, and approve any paid call, software install, upgrade, or token change explicitly.
The trigger condition says similar requests 'must trigger,' which is overly broad and ambiguous. In an agent setting, this can cause over-triggering on loosely related e-commerce discussion and unexpectedly invoke paid/networked tooling without sufficiently specific user intent.
The example trigger phrase '跨境允许销售的爆款' is broad enough to overlap with ordinary discussion rather than a clear request to run this specific tool. That increases the risk of unintended activation, especially because the tool can incur charges and perform external calls.
The skill goes beyond product-ranking behavior and contains environment-bootstrapping instructions to install Node.js and packages. This expands the agent's authority from querying data into modifying the host environment and executing network-fetched software, increasing attack surface and operational risk.
The skill instructs installation, configuration, and network-backed execution but does not provide a clear up-front risk disclosure before those actions. Users may not realize the agent could modify the system, contact external services, or persist credentials, undermining informed consent.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact package version. That allows execution of whatever version is current at runtime, which weakens reproducibility and creates a supply-chain risk if a compromised or incompatible release is published.
This duplicate finding reflects the same session-persistence issue: unpacking Node into $HOME/.local/lib and changing PATH extends the agent's effective capabilities beyond the current action. In skill context, that is risky because a data-query skill should not be self-escalating into environment provisioning.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding reflects the same session-persistence issue: unpacking Node into $HOME/.local/lib and changing PATH extends the agent's effective capabilities beyond the current action. In skill context, that is risky because a data-query skill should not be self-escalating into environment provisioning.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs persistent credential setup via local config or environment variables. This is dangerous because it causes the agent to handle secrets and alter durable authentication state on the host, which is broader than the stated query task and can expose credentials or contaminate future sessions.
No suspicious patterns detected.