Security audit
Security checks for vulnerabilities and agentic risk
The skill’s main data-query purpose is clear, but it also tells the agent to install and upgrade host tools and configure API credentials, so it needs review before use.
Install only if you are comfortable with qhkit accessing the Qinghu service using your token and consuming Qinghu credits. Prefer a pre-provisioned or version-pinned qhkit installation, avoid letting the skill modify shell startup files automatically, and review any global npm, Node, or token-configuration step before allowing it.
The trigger scope includes vague language such as '同类需求', which can cause the skill to activate for loosely related requests. In context, that matters because activation may lead to paid external calls, credential checks, or environment modification guidance, so ambiguous routing increases unintended execution risk.
The skill goes beyond its stated purpose of querying live replay data by directing the agent to install Node.js, globally install/upgrade a CLI, and configure credentials on the host. These are host-environment modifications that expand trust boundaries, enable persistent changes, and increase the chance of unsafe software installation or credential handling during normal skill invocation.
The skill instructs fallback execution via npx @iqinghu/qhkit without pinning an exact package version. That allows whatever version is current at execution time to be fetched and run, creating a supply-chain and reproducibility risk if the package is updated maliciously or incompatibly.
This duplicate finding points to the same persistent installation behavior: unpacking Node into the user's home directory and exporting it into PATH. Even with checksum verification, persistence and environment mutation are unsafe in a skill intended only to query an external data tool, because they enlarge the attack surface and survive beyond the original task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistent installation behavior: unpacking Node into the user's home directory and exporting it into PATH. Even with checksum verification, persistence and environment mutation are unsafe in a skill intended only to query an external data tool, because they enlarge the attack surface and survive beyond the original task.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
L018 使用了非常简短的口语化触发语，但未限制必须是在视频号账号查询场景下才触发，也没有给出负面示例。这类表达在一般聊天中也可能出现，容易造成误触发。
No suspicious patterns detected.