Security audit
Security checks for vulnerabilities and agentic risk
The skill has a clear data-query purpose, but it asks agents to install or update tooling and configure an API token in ways users should review first.
Review this skill before installing if you do not want an agent to modify your local Node/npm environment or configure a Qinghu API token. Prefer a preinstalled, pinned qhkit version and provide credentials through a controlled secret store or per-session environment variable. Confirm paid Qinghu credit usage before any call.
The manifest description specifies only Chinese trigger examples and says the skill 'must trigger' for similar requests, but it does not offer any user language/locale choice. This creates a natural-language locale policy concern because the skill appears to enforce a specific language context without opt-in or justification.
The skill's documented behavior goes far beyond querying collection data: it tells the agent to install Node.js, globally install packages, and upgrade tooling. That expands the skill from a narrow data-retrieval capability into environment modification and software management, increasing blast radius if the instructions are followed automatically.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which allows resolution of whatever package version is current at execution time. In an agent context this creates supply-chain risk and undermines reproducibility, especially because the package is then trusted to perform external calls and handle credentials.
This duplicate finding identifies the same persistence behavior: unpacking Node into a user-controlled directory and exporting a modified PATH, with optional persistence across sessions. In context, the danger is not the specific package alone but the skill encouraging durable host changes unrelated to its narrow business purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same persistence behavior: unpacking Node into a user-controlled directory and exporting a modified PATH, with optional persistence across sessions. In context, the danger is not the specific package alone but the skill encouraging durable host changes unrelated to its narrow business purpose.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs persistent credential configuration via qhkit config set --token or QHKIT_TOKEN. This introduces secret-handling and storage behavior unrelated to the stated query function, and can cause long-lived credentials to be written into the host environment where other processes or later sessions may access them.
No suspicious patterns detected.