Security audit
Security checks for vulnerabilities and agentic risk
The skill’s RedNote data lookup purpose is clear, but it gives the agent broad automatic setup authority that can install tools, change the local environment, and store an API token.
Review before installing. The data lookup itself is understandable and paid calls require consent, but this skill may install or upgrade local software and configure an API token. Prefer using it only in an environment where qhkit and Node are already provisioned, and approve any installation or credential setup explicitly.
The trigger language says the skill 'must' activate for vague 'similar requests,' which can cause overbroad invocation. In security terms, ambiguous activation criteria increase the chance that the agent invokes paid external tooling or performs side effects when the user did not clearly request this specific capability.
The invocation examples are broad and lack explicit boundaries, making accidental or premature activation more likely. In this skill, that matters because activation can lead to external calls, paid usage, installation guidance, and credential handling, so ambiguity directly raises operational risk.
The skill explicitly expands scope to qhkit mcp search across 200+ tools, which breaks the claimed narrow purpose of note-detail lookup. Broad tool discovery from within a specialized skill can enable lateral capability expansion and unexpected data access beyond user intent or policy review.
This skill goes far beyond simple note-data retrieval by directing the agent to install software, bootstrap runtime dependencies, configure API tokens, and modify the local environment. Those actions increase the attack surface substantially because a content-retrieval skill should not be authorized to perform persistent system changes or credential setup on the host.
The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact package version. That permits retrieval of whatever package version is current at execution time, creating supply-chain risk and making behavior non-deterministic if the upstream package is compromised or changes unexpectedly.
This duplicate finding identifies the same persistent environment modification behavior: installing Node under the home directory and changing PATH. Even with checksum verification, the issue is that the skill normalizes host persistence and executable-path changes for a task that should be narrowly scoped to note-data retrieval.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same persistent environment modification behavior: installing Node under the home directory and changing PATH. Even with checksum verification, the issue is that the skill normalizes host persistence and executable-path changes for a task that should be narrowly scoped to note-data retrieval.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
No suspicious patterns detected.