Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned for collecting RedNote comments, but it should be reviewed because it can automatically install unpinned tooling and persist paid-service credentials on the user's machine.
Before installing, confirm you trust qhkit and the Qinghu service, understand that requests may consume paid Qinghu credits, and prefer a platform-managed or pinned qhkit install with ephemeral token handling. Avoid letting the skill bootstrap Node/npm or store long-lived tokens unless that is acceptable for your environment.
The trigger definition includes broad language such as requiring activation for similar requests, which can cause the skill to run on loosely related user messages. Because this skill can install software, configure credentials, and make paid external calls, over-broad invocation materially increases the chance of unintended execution and side effects.
The trigger example '评论区都在问什么' is a natural conversational request that could appear in general discussion, and the document does not constrain it to a command context or require a RedNote note URL at activation time. Without stricter scope, the skill may activate on broad, everyday phrasing.
For a skill whose stated purpose is collecting comments from a RedNote note, instructing the agent to install Node.js and globally install tooling substantially expands its authority and attack surface. This turns a narrow data-retrieval skill into an environment-bootstrapper capable of modifying the host, fetching code from the internet, and introducing persistent dependencies unrelated to the immediate user request.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact package version, which allows whatever the registry serves as latest to be executed at runtime. In a security-sensitive agent context, that creates supply-chain risk and makes behavior non-reproducible, especially because the same document also encourages installation and credential configuration for that package.
This duplicated finding describes the same persistence behavior: unpacking software into a user directory and exporting a modified PATH. In a skill intended only for comment collection, persistent environment mutation is unnecessary and increases long-term risk if later commands unknowingly use the newly installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding describes the same persistence behavior: unpacking software into a user directory and exporting a modified PATH. In a skill intended only for comment collection, persistent environment mutation is unnecessary and increases long-term risk if later commands unknowingly use the newly installed binaries.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs the agent to set persistent authentication credentials via qhkit config set --token or environment variables, causing secrets to be stored in the host environment. In an agent setting, that is dangerous because it encourages handling and persisting credentials outside a dedicated secret-management boundary, increasing the chance of leakage, reuse, or misuse by other tools and sessions.
No suspicious patterns detected.