Security audit
Security checks for vulnerabilities and agentic risk
The skill’s main RedNote data-fetching purpose is clear, but it also tells agents to install and upgrade tooling, download Node, change PATH, and store API credentials with limited user control.
Review before installing. Use this skill only if you are comfortable with qhkit accessing a paid Qinghu account, storing an API token, and making local tooling changes. Prefer preinstalling and pinning qhkit yourself, and approve paid calls only after checking the estimate.
The description says requests like pulling all a creator’s notes or doing account benchmarking 'must trigger,' and includes broad keywords that can overlap with general analysis tasks. This increases the chance of unintended invocation, which is more dangerous here because invocation can lead to paid external calls and environment-changing setup behavior.
The trigger examples are short and broad, especially '对标账号作品分析', which can overlap with multi-step competitive analysis outside the skill’s narrow stated function. Ambiguous triggers can cause the skill to run in situations where the user did not intend this specific paid data collection flow.
The skill goes beyond its stated purpose of fetching RedNote creator notes by instructing the agent to install Node, install or upgrade CLI software, and persistently configure API credentials. In an agent setting, these actions expand the trust boundary, modify the host environment, and may expose secrets or create lasting changes unrelated to the user’s immediate data request.
The skill instructs using npx @iqinghu/qhkit without pinning a specific version, which causes execution of whatever package version is current at runtime. That creates a supply-chain risk and undermines reproducibility, especially because the package is used to access external services and handle authentication.
This duplicate finding points to the same persistence behavior: extracting binaries into the user profile and exporting a modified PATH. Even if partly framed as session-local, the instructions also encourage durable installation patterns and therefore exceed the minimum privileges needed for the skill’s purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: extracting binaries into the user profile and exporting a modified PATH. Even if partly framed as session-local, the instructions also encourage durable installation patterns and therefore exceed the minimum privileges needed for the skill’s purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
No suspicious patterns detected.