Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent paid Ozon shop-data helper, but it needs review because it can automatically install unpinned tooling, change local configuration, and store or use an API token.
Install only if you are comfortable letting the agent install or upgrade Node/npm tooling, run qhkit, configure a Qinghu API token, and spend Qinghu credits after consent. Prefer preinstalling a reviewed/pinned qhkit version and providing credentials through a secure secret mechanism before using the skill.
The manifest description says the skill 'must trigger' for broad natural-language requests like head shops, benchmarking shops, and sales-range searches. Overbroad activation can cause the wrong skill to run unexpectedly, which is more dangerous here because the skill can lead to installs, credential setup, and paid external calls.
The trigger section provides broad examples without meaningful boundaries, increasing the chance of accidental invocation on generic e-commerce analysis requests. In this skill, misrouting is consequential because activation may steer the agent into external tool usage, payment prompts, and local setup steps not warranted by the original request.
The skill instructs the agent to install Node.js, globally install a CLI, and modify the local environment in order to fulfill a data-query task. That exceeds the minimum privileges needed for a shop-ranking lookup and expands the attack surface by enabling persistent software installation on the host.
The skill recommends executing npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to run arbitrary install-time and runtime code. In a skill context, this creates a supply-chain risk and reduces reproducibility, especially because the command is presented as a fallback path for obtaining the required tool.
This duplicated finding points to the same persistence behavior: unpacking software into the user home directory and exporting a modified PATH. Such session and filesystem persistence is unnecessary for the skill’s stated purpose and increases host-level risk relative to the business function.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: unpacking software into the user home directory and exporting a modified PATH. Such session and filesystem persistence is unnecessary for the skill’s stated purpose and increases host-level risk relative to the business function.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs the agent to set API tokens and manipulate credential-related environment/configuration state. Handling secrets inside a broadly invocable skill increases the risk of credential exposure, accidental persistence, or misuse beyond the user’s immediate request.
The file states that the skill must use the domestic cn site configuration and not guide users toward the intl site unless they explicitly say they use AutoAGC. This imposes a locale/site constraint in the instructions rather than offering the user a neutral choice by default.
No suspicious patterns detected.