Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Qinghu/RedNote publishing-code integration, with notable but purpose-aligned install and token setup risks.
Before installing, confirm you trust the qhkit package and Qinghu service, approve any Node/npm installation or upgrade, and decide whether the token should be stored in qhkit config or supplied through an environment variable. Check the site setting before overwriting an existing international account configuration, and expect paid qhkit calls to consume Qinghu credits after you authorize them.
The skill goes far beyond its stated purpose of generating a RedNote publish code by directing installation of Node.js, global package installation, upgrades, and environment bootstrapping. Expanding scope this way increases attack surface and can cause the agent to modify the host system in ways the user did not explicitly request or expect.
The skill instructs the agent to install software and configure credentials, including setting API tokens, without a prominent host-modification and secret-handling warning. This is dangerous because it can lead to persistent system changes and sensitive credential exposure or misuse under the guise of a routine content-generation task.
The skill instructs the agent to run npx @iqinghu/qhkit without pinning an exact version, which allows whatever package version is current at execution time to be fetched and executed. That creates a supply-chain risk and makes behavior non-reproducible, especially because this package is then used to access credentials and external services.
This finding is substantively the same persistence issue: the instructions establish a user-local runtime and alter execution paths in a way that can outlive the session. Persistent environment modification is risky because it changes future command resolution and broadens the consequences of any compromised or misconfigured dependency.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This finding is substantively the same persistence issue: the instructions establish a user-local runtime and alter execution paths in a way that can outlive the session. Persistent environment modification is risky because it changes future command resolution and broadens the consequences of any compromised or misconfigured dependency.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill forces a China-site configuration unless the user explicitly states otherwise, overriding user/environment context and steering credentials toward a specific service endpoint. In practice, this can cause accidental credential misuse, policy mismatches, or data routing to an unintended locale, which is especially sensitive for account-bound API operations.
No suspicious patterns detected.