Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Shopee product lookup integration, but it also directs the agent to install software, run unpinned packages, and alter qhkit authentication/configuration, which should be reviewed before use.
Review this skill before installing if you do not want an agent to install Node/qhkit packages, run unpinned npm/npx code, or change qhkit token and site configuration. If used, prefer installing qhkit yourself from a trusted, pinned version and provide credentials through your normal platform controls; approve paid calls only after checking the listed Qinghu credit cost.
The manifest description says the skill must trigger when users say "品牌爆款" or similar requests. This phrase is short and generic in e-commerce conversations, so it may match many ordinary requests that do not specifically intend this exact Shopee brand hot-products skill.
The phrase "或提出同类需求时必须触发" expands activation beyond the listed examples but does not define what counts as similar. Without explicit scope or negative examples, the skill may be invoked for loosely related brand-analysis requests.
For a read-only product lookup skill, the environment self-bootstrapping section is overprivileged: it directs the agent to install Node.js, globally install packages, and alter local runtime state. This expands the skill from a bounded data query into arbitrary environment modification, increasing the attack surface and enabling persistence or unintended system changes on the host.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at invocation time. That creates supply-chain and reproducibility risk: a later compromised or incompatible release could be pulled into the agent environment and executed implicitly.
This duplicated finding identifies the same persistence behavior: extracting Node into a user-controlled directory and exporting a new executable path. Even if framed as temporary bootstrap, it normalizes host modification and can survive beyond the intended task if shell profiles are later updated as the skill suggests.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding identifies the same persistence behavior: extracting Node into a user-controlled directory and exporting a new executable path. Even if framed as temporary bootstrap, it normalizes host modification and can survive beyond the intended task if shell profiles are later updated as the skill suggests.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to inspect configuration state, set API tokens, and potentially modify environment-derived settings. That is unjustified for the user-facing lookup task and can expose secrets, alter authentication context, or cause the agent to manipulate sensitive configuration that should remain under explicit user or platform control.
The instructions mandate use of the domestic iqinghu.com site, Chinese-language credential guidance, and explicitly steer away from the international configuration unless the user states otherwise. This imposes a locale-specific workflow by default rather than offering the user a language or locale choice.
No suspicious patterns detected.