Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Shopee brand-shop lookup that uses the qhkit CLI and paid Qinghu data APIs, with setup steps that users should review before allowing installation or token configuration.
Before installing, confirm you trust the qhkit npm package and Qinghu account workflow. Expect the skill to install or use qhkit, ask for a Qinghu token if not configured, estimate paid credit use before calls, and potentially write tool/runtime files under the user environment if dependencies are missing.
The trigger language includes vague phrases like 'or similar needs,' which can cause the skill to activate for loosely related requests. Overbroad activation is risky here because the skill can lead to package installation, credential setup, and external tool invocation, not just passive formatting or lookup.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
按品牌名查询售卖该品牌的热销店铺列表。
数据来自**青虎数据工具** `queryshopeebrandshoplist`（查品牌店铺列表，平台：Shopee），通过 `qhkit mcp` 调用——**不需要、也不要去宿主环境里找或配置 MCP server**。
## 何时触发
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
按品牌名查询售卖该品牌的热销店铺列表。
数据来自**青虎数据工具** `queryshopeebrandshoplist`（查品牌店铺列表，平台：Shopee），通过 `qhkit mcp` 调用——**不需要、也不要去宿主环境里找或配置 MCP server**。
## 何时触发
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
按品牌名查询售卖该品牌的热销店铺列表。
数据来自**青虎数据工具** `queryshopeebrandshoplist`（查品牌店铺列表，平台：Shopee），通过 `qhkit mcp` 调用——**不需要、也不要去宿主环境里找或配置 MCP server**。
## 何时触发
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
按品牌名查询售卖该品牌的热销店铺列表。
数据来自**青虎数据工具** `queryshopeebrandshoplist`（查品牌店铺列表，平台：Shopee），通过 `qhkit mcp` 调用——**不需要、也不要去宿主环境里找或配置 MCP server**。
## 何时触发
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
按品牌名查询售卖该品牌的热销店铺列表。
数据来自**青虎数据工具** `queryshopeebrandshoplist`（查品牌店铺列表，平台：Shopee），通过 `qhkit mcp` 调用——**不需要、也不要去宿主环境里找或配置 MCP server**。
## 何时触发
The skill is nominally a brand-shop query skill, but it contains extensive instructions to install software, configure tokens, and modify the host environment. That broadens the operational scope from data retrieval to host bootstrapping, increasing the chance an agent performs unnecessary privileged or security-sensitive actions on the user's machine.
The skill instructs use of npx @iqinghu/qhkit without pinning a version, which makes execution depend on whatever package version is current at runtime. That creates supply-chain and reproducibility risk: a later compromised or breaking release could be fetched and executed on the host unexpectedly.
This duplicate finding correctly identifies persistent host modification guidance: unpacking software under $HOME/.local/lib and exporting PATH changes runtime state and may lead to longer-lived setup when users follow nearby advice. Embedding such steps in a data-query skill unnecessarily expands the skill's authority and operational footprint.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding correctly identifies persistent host modification guidance: unpacking software under $HOME/.local/lib and exporting PATH changes runtime state and may lead to longer-lived setup when users follow nearby advice. Embedding such steps in a data-query skill unnecessarily expands the skill's authority and operational footprint.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill hardcodes Chinese user-facing text to send to users, including credential guidance and follow-up instructions, without indicating that the language should match the user's preference. This creates a locale policy issue because it forces a specific language absent user opt-in or documented justification.
The documentation recommends persisting environment changes such as appending to ~/.bashrc, which is unrelated to the core query task and can affect future shell sessions. Persistent shell modifications increase blast radius by changing host behavior beyond the current invocation.
No suspicious patterns detected.