Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该描述除列出两个示例触发语外，还要求对“同类需求”必须触发，但没有说明哪些相近表述不应触发，范围过于开放。对品牌、趋势、销量等日常查询语句都可能产生重叠，增加非预期调用的风险。
- Content
Security audit
Shopee-品牌每日趋势 | 青虎AI
Security checks for vulnerabilities and agentic risk
Overview
The skill’s Shopee brand-trend query is coherent, but it also tells the agent to install software, alter local configuration, and handle API tokens with too little up-front user control.
Install only if you trust the qhkit publisher and are comfortable with the agent installing Node/npm packages and configuring a paid API token. Prefer preinstalling qhkit yourself, pinning versions, reviewing any PATH or shell profile changes, and approving paid calls with a clear credit estimate.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill goes beyond querying brand trends and contains extensive environment bootstrapping, package installation, PATH changes, token setup, and upgrade instructions. This broadens the attack surface substantially: a simple data-query skill now encourages executing multiple privileged or persistence-affecting setup actions that could be abused or socially engineered.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document tells the agent/user to install software, modify configuration, and set API tokens without clearly requiring up-front risk disclosure and consent at the start of the setup section. This is dangerous because it can lead to silent environment changes, credential handling, and paid tool enablement under the guise of a routine analytics query.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill instructs use of
npx @iqinghu/qhkitwithout pinning a specific version, which allows future package changes or a compromised latest release to alter behavior at execution time. In a skill that also recommends installation and credential configuration, this increases supply-chain risk because users may fetch and run unreviewed code implicitly.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
This duplicated finding points to the same persistence behavior: extracting software into a user-local directory and prepending it to
PATH. Even with checksum verification, the skill is still directing durable environment modification unrelated to its core function, which expands trust and execution scope unnecessarily.- Content
Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
This duplicated finding points to the same persistence behavior: extracting software into a user-local directory and prepending it to
PATH. Even with checksum verification, the skill is still directing durable environment modification unrelated to its core function, which expands trust and execution scope unnecessarily.- Content
Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
text
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
该段明确规定“site 必须是 cn”，并指示不要按国际站引导，只有在用户明确声明使用国际版账号时才保留 intl。对于区域/站点选择，这是一种默认强制策略，未以用户选择或显式 opt-in 为前提。
- Content
Static analysis
No suspicious patterns detected.