Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its advertised share-link purpose, but it also tells the agent to install software, alter the user environment, and configure an API token, so it should be reviewed before use.
Install only if you are comfortable letting this skill use qhkit for paid Qinghu data calls and potentially set up local tooling. Prefer an environment where Node and qhkit are already installed by a trusted package manager, avoid unpinned npx/latest execution, and provide API tokens through a controlled secret mechanism rather than storing long-lived credentials casually on the host.
The manifest description is entirely in Chinese and states the skill 'must trigger' for Chinese trigger phrases, but it does not indicate that the skill is intentionally limited to Chinese users or offer any language/locale opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
The skill’s stated purpose is only to generate a share link from an object_id, but it includes broad environment bootstrapping: installing Node, downloading binaries, modifying PATH, and upgrading packages. This materially expands the agent’s authority and attack surface from simple data retrieval to arbitrary software installation and execution on the host.
The skill instructs use of npx @iqinghu/qhkit without a pinned version, allowing execution of whatever package version is current at runtime. In a security-sensitive agent context, this creates supply-chain risk and undermines reproducibility, especially because the same skill also encourages installing and running external tooling before performing a narrow task.
This duplicated finding points to the same persistence behavior: unpacking software under the user home directory and altering PATH. Such session or host modification is not necessary for converting an object_id to a share link and meaningfully increases the blast radius if the skill is invoked in a sensitive environment.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: unpacking software under the user home directory and altering PATH. Such session or host modification is not necessary for converting an object_id to a share link and meaningfully increases the blast radius if the skill is invoked in a sensitive environment.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to obtain and persist API credentials via qhkit config set --token or environment variables, which exceeds the narrow share-link use case. This can cause long-lived secret storage on the host and normalization of credential handling by an untrusted skill, increasing risk of secret exposure or misuse in later sessions.
No suspicious patterns detected.