ClawHub
Back to skill

Security audit

小红书-热搜榜 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent RedNote hot-search integration, but users should be aware it installs and configures the qhkit CLI and can spend Qinghu credits after consent.

Install only if you want to use Qinghu/qhkit for Xiaohongshu hot-search data. Review the npm/qhkit and Node installation steps, confirm any token or site changes before applying them, and note that paid calls require your consent and consume Qinghu credits.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L003 将“找选题”列为必须触发的同类需求示例，但该短语没有限定平台、热搜榜或小红书语境，属于常见自然表达。文档也没有提供排除条件或负例来界定何时不应触发，因此触发范围过宽。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L003 在列举少量示例后使用“同类需求”扩展触发范围，但没有说明同类的判定标准，也未给出反例或约束条件。这样的描述会让调用边界依赖主观解释，增加非预期调用风险。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact version, which permits fetching whatever package version is current at invocation time. In a skill context that encourages automatic environment bootstrapping and package installation, this increases supply-chain risk and reduces reproducibility, especially if a compromised or breaking release is published.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

This duplicate finding refers to the same persistent installation behavior: extracting binaries into a user-controlled directory and prepending them to PATH. In a skill that may be followed by an automated agent, such persistence can survive the current task and affect later sessions or tools, making misuse or unexpected binary shadowing more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

This duplicate finding refers to the same persistent installation behavior: extracting binaries into a user-controlled directory and prepending them to PATH. In a skill that may be followed by an automated agent, such persistence can survive the current task and affect later sessions or tools, making misuse or unexpected binary shadowing more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

L092 明确规定“site 必须是 cn”，并要求发现 intl 配置时覆盖为国内站，只有用户明确说明使用国际版账号时才保留。该表述对地区/站点选择采用默认强制策略，而不是先询问用户偏好或账号所属站点，符合语言/locale policy violation 的特征。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.