Security audit
Security checks for vulnerabilities and agentic risk
This skill performs the advertised Qinghu video-collection lookup, but it also tells agents to install or upgrade local tooling and persist API credentials on the host.
Install only if you are comfortable letting the skill use Qinghu qhkit and spend Qinghu credits after consent. Prefer a preinstalled, pinned qhkit version in a disposable or managed environment, and use temporary secret injection instead of storing an API token in local config. Review any proposed Node/npm install, PATH change, or ~/.bashrc change before allowing it.
This markdown file defines activation triggers, so SQP-1 applies. The standalone phrase "合集作品" lacks context such as platform, tool, or required intent, making it ambiguous when the skill should activate versus when a user may simply be referring to collection content in general.
The skill contains extensive environment-bootstrapping instructions—installing Node, installing packages globally, downloading binaries, and modifying PATH—that are much broader than the narrow task of querying collection videos. This expands the agent's authority from data retrieval into host modification, increasing the risk of unintended system changes, persistence, and execution of third-party code on the host.
The skill recommends running npx @iqinghu/qhkit without pinning an exact package version, which allows retrieval of whatever version is current at execution time. In a host-integrated agent context, this creates supply-chain and reproducibility risk because a newly published or compromised package version could change behavior or execute unintended code.
This duplicate finding points to the same persistence behavior: extracting Node into a user directory and exporting a modified PATH. In a least-privilege agent model, such persistence is unsafe because it converts a one-off data lookup capability into software installation and environment reconfiguration on the host.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: extracting Node into a user directory and exporting a modified PATH. In a least-privilege agent model, such persistence is unsafe because it converts a one-off data lookup capability into software installation and environment reconfiguration on the host.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to set persistent API credentials via qhkit config set --token or consume QHKIT_TOKEN from the host environment. In an agent setting, this can cause secrets to be written into persistent config stores or encourage access to host credentials beyond the immediate task, increasing the blast radius of compromise and the chance of credential leakage or misuse.
No suspicious patterns detected.