Security audit
Security checks for vulnerabilities and agentic risk
The skill’s data-lookup purpose is coherent, but it asks agents to install unpinned tools, modify the local runtime, and configure API tokens on the host as part of normal use.
Review before installing. This skill is suitable only if you trust qhkit and the Qinghu service, accept paid API calls, and are comfortable with the agent installing Node/npm tooling and storing or using a Qinghu API token. Prefer a preinstalled, version-pinned qhkit and a managed secret store instead of letting the skill bootstrap tools and credentials during a lookup.
The manifest description requires activation for the listed phrases or any "similar request," but does not define what counts as similar. This creates an ambiguous activation boundary and can cause the skill to trigger on loosely related everyday requests.
The activation examples include the standalone phrase "达人筛选", which is not narrowly tied to querying RedNote creator profile data and could overlap with many broader influencer-search or marketing tasks. The description also says similar requests "必须触发", increasing the risk of unintended invocation without clearer boundaries or exclusions.
For a skill whose stated purpose is fetching creator profile data, the environment-bootstrapping section instructs the agent to install Node.js, globally install packages, and modify the host PATH. These are host-environment changes well beyond least privilege and enlarge the attack surface, enabling persistent software installation as part of ordinary skill use.
The skill recommends executing npx @iqinghu/qhkit without pinning a version, which makes behavior dependent on the latest published package at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched and run in the host environment during a routine data lookup flow.
The same persistence pattern appears in a duplicated finding: software is installed into a user-controlled directory and the session environment is altered to prefer that binary. Even with checksum verification, this remains unnecessary persistence for the stated business function and increases the blast radius of any future compromise or misuse.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The same persistence pattern appears in a duplicated finding: software is installed into a user-controlled directory and the session environment is altered to prefer that binary. Even with checksum verification, this remains unnecessary persistence for the stated business function and increases the blast radius of any future compromise or misuse.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to persist authentication credentials via qhkit config set --token or environment variables in the host environment. Persisting tokens on the host for a simple profile-lookup skill creates credential-handling and cross-session exposure risk if logs, shell history, config files, or other processes can access them.
No suspicious patterns detected.