Security audit
Security checks for vulnerabilities and agentic risk
The skill’s Shopee brand-trend purpose is clear, but it also directs agents to install and update runtime tools and persist API credentials in ways users should review before installing.
Review this skill before installing if you are not comfortable with an agent installing or updating qhkit/Node, changing PATH-related setup, or storing Qinghu API credentials locally. Prefer using a preinstalled, pinned qhkit version and a scoped secret-management mechanism where possible.
The description says the skill 'must trigger' for similar requests and includes broad keyword-driven activation language. This can cause the skill to run in situations the user did not explicitly intend, increasing the chance of unnecessary external calls, billing, or execution of the skill's risky setup steps.
The '何时触发' section provides only three positive examples, including generic phrases like '按季度看品牌趋势' and '多站点对比品牌表现', but does not define when similar requests should not trigger. Without scope limits or negative examples, the invocation condition remains ambiguous.
The skill goes far beyond a brand-trend query by directing the agent to install Node, install global packages, alter PATH, and bootstrap runtime dependencies. Those actions expand the attack surface substantially and can modify the host environment persistently, which is not justified by the business function of querying trend data.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows execution of whatever package version is current at invocation time. That creates supply-chain and reproducibility risk: a compromised, malicious, or breaking upstream release could be fetched and executed in the agent environment.
This duplicated finding points to the same persistence behavior: downloading and extracting Node into the home directory and exporting a modified PATH. Such stateful environment changes can outlive the task, complicate auditing, and enable unintended future tool execution paths.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: downloading and extracting Node into the home directory and exporting a modified PATH. Such stateful environment changes can outlive the task, complicate auditing, and enable unintended future tool execution paths.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs the agent to read credentials from environment variables or persist them via qhkit config set --token, including guidance around overwriting environment configuration. This encourages secret handling and persistent auth changes that exceed the scope of a trend-query skill and increase the risk of credential exposure, misuse, or cross-context account confusion.
These lines instruct the agent to provide domestic-site key retrieval guidance using fixed Chinese websites and wording, and to avoid international-site guidance unless the user explicitly says otherwise. This imposes a specific language/locale workflow without offering the user a choice, which is a natural-language locale policy concern.
No suspicious patterns detected.