Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to do what it says: search RedNote/Xiaohongshu through a paid qhkit service, with setup and supply-chain caveats users should approve.
Install only if you are comfortable installing qhkit/Node tooling, configuring a Qinghu API token, and spending Qinghu credits. In locked-down environments, preinstall or approve a pinned qhkit version instead of allowing ad hoc global installs or npx latest-version execution, and confirm the first paid call before searching.
The trigger description contains a broad catch-all such as requests for 'similar needs must trigger,' which can cause the skill to activate on ambiguous or loosely related user inputs. Overbroad invocation rules increase the chance of unintended external tool use, including paid actions and data access, without clear user intent.
The listed trigger phrase 竞品种草笔记 is vague and may match general discussion rather than an explicit request to search RedNote notes. In this skill context, ambiguous triggers are risky because they can cause unintended tool execution and possible charges even when the user has not clearly asked for a search.
This note-search skill includes broad environment bootstrapping steps to install Node.js and globally install or upgrade qhkit, which exceeds the minimum scope needed for a narrowly defined search capability. Allowing a skill to direct system software installation expands the attack surface, can alter the host persistently, and could be abused to justify risky package execution in environments that otherwise would not permit it.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific package version. That makes execution dependent on whatever version is current at runtime, increasing supply-chain risk and making behavior non-deterministic if the package changes or a compromised release is published.
This duplicate finding points to the same persistence behavior: extracting Node.js into a user-controlled directory and exporting a new PATH for subsequent commands. In a skill intended only to search notes, such stateful host modification is unnecessarily powerful and can enable follow-on execution of unvetted tooling in later steps.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: extracting Node.js into a user-controlled directory and exporting a new PATH for subsequent commands. In a skill intended only to search notes, such stateful host modification is unnecessarily powerful and can enable follow-on execution of unvetted tooling in later steps.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
No suspicious patterns detected.