ClawHub
Back to skill

Security audit

Ozon-店铺趋势 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

The skill’s shop-trend purpose is legitimate, but it tells the agent to install and run unpinned external tooling and modify the user environment during normal use.

Install only if you are comfortable letting the skill install qhkit/Node from npm or Node mirrors and configure a qhkit token. Prefer using it in an environment where qhkit is already installed and version-pinned, and review any paid-call consent and token setup before proceeding.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly directs arbitrary package installation and binary download paths, including Node installation and archive extraction, for a context that should only require querying shop trend data. Even with checksum guidance, this encourages code acquisition and execution from external sources during normal operation, which is disproportionate to the skill's purpose and increases supply-chain and host-compromise risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

L003 在列举示例后又使用“提出同类需求时必须触发”，但没有定义“同类需求”的判定标准或排除情形。这样的表述会让技能触发范围扩张到不明确的相似请求，增加误触发风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该文件是 markdown，适用 SQP-1。L018 仅写“店铺增长情况”，缺少平台、工具范围或排除条件，可能匹配到泛化的店铺经营分析请求，而不一定特指 Ozon 店铺趋势快照查询。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This documentation goes beyond describing a read-only analytics skill and instructs the agent to modify the host environment by installing software, setting credentials, and reconfiguring runtime state. That expands the trust boundary substantially and can cause persistent system changes or secret handling actions unrelated to answering the user's immediate query.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact package version. That creates a supply-chain risk because the resolved package version can change over time, leading to unreviewed code execution in the host environment during a routine shop-trend task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This finding duplicates the same persistence behavior: extracting a runtime into a user directory and exporting it into PATH alters future command resolution within the session and potentially beyond if adopted into shell startup files. In the context of a shop-trend query skill, that persistence is unnecessary and increases operational and supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This finding duplicates the same persistence behavior: extracting a runtime into a user directory and exporting it into PATH alters future command resolution within the session and potentially beyond if adopted into shell startup files. In the context of a shop-trend query skill, that persistence is unnecessary and increases operational and supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

L100 明确要求仅按国内版站点引导，并强调不要按国际站答复，整体文档也完全以中文固定交互路径呈现。对于未明确声明必须面向中文/国内用户的技能，这种强制 locale 约束缺少用户选择或显式 opt-in，符合语言/区域策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.