Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Ozon shop-detail lookup wrapper around qhkit, with ordinary install and API-token requirements but no hidden or destructive behavior in the artifact.
Before installing, confirm you are comfortable installing qhkit/Node, storing or providing a Qinghu API token, and spending Qinghu credits for Ozon shop-detail queries. Prefer a trusted npm source, review any cost estimate before approving calls, and avoid using this skill for broader competitor analysis unless shop IDs and shop-detail data are specifically what you need.
The description says the skill must trigger when the user says "竞店数据" or similar requests, but that phrase is generic and could refer to many kinds of competitor-store analyses, not specifically Ozon shop-detail queries. The file does not provide exclusion conditions or negative examples to distinguish this skill from related Ozon competitor-analysis skills.
The phrase "或提出同类需求时必须触发" leaves activation scope undefined, making it unclear which neighboring intents count as equivalent. Because the skill ecosystem includes adjacent Ozon analysis skills, this ambiguity could cause unintended invocation of the wrong skill.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at invocation time. This creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be fetched and executed in the user's environment.
This duplicate finding reflects the same persistent installation behavior: extracting binaries into a user-controlled directory and exporting them for subsequent command execution. In a skill context, instructions that alter the runtime environment are more dangerous because they normalize installing and executing external software as part of ordinary use.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding reflects the same persistent installation behavior: extracting binaries into a user-controlled directory and exporting them for subsequent command execution. In a skill context, instructions that alter the runtime environment are more dangerous because they normalize installing and executing external software as part of ordinary use.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
No suspicious patterns detected.