Security audit
Security checks for vulnerabilities and agentic risk
This looks like a legitimate Shopee trend-query helper, but it also directs the agent to install software and persist API credentials on the host.
Review before installing. Only use this skill if you are comfortable letting the agent install or update qhkit/Node tooling and configure a Qinghu API token on the machine. Prefer a preinstalled, version-pinned qhkit setup and provide credentials through a controlled secret mechanism rather than persistent config when possible. Paid calls are disclosed and require user authorization in the skill.
The trigger phrase 或提出同类需求时必须触发 is overly broad and can cause the skill to activate for loosely related requests. In this skill, over-triggering is more dangerous because activation may lead to package installation, credential configuration, and paid external tool calls rather than a harmless local transformation.
The skill goes beyond querying category trends and tells the agent to bootstrap the environment by installing Node.js and npm packages, including downloading binaries and modifying PATH. This materially increases capability from data retrieval to host modification and code execution, which is dangerous if triggered automatically or in a sensitive environment.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, so each invocation may fetch whatever version is current at execution time. That expands the trust boundary to the live package registry and creates a supply-chain risk where changed or compromised upstream code could execute in the host environment.
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and changing PATH for future command resolution. In the context of a simple analytics-query skill, such environment persistence is unnecessary and enlarges post-task attack surface.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistence behavior: unpacking Node into a user-controlled directory and changing PATH for future command resolution. In the context of a simple analytics-query skill, such environment persistence is unnecessary and enlarges post-task attack surface.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs configuring persistent credentials in the host environment via qhkit config set --token or environment variables. Storing service tokens on the host broadens access beyond the immediate task, can persist across sessions, and may expose credentials to other processes, logs, or later misuse.
The file gives two short example utterances, but it does not define the full trigger scope or distinguish this skill from adjacent category-analysis skills. Without exclusions or clearer constraints, the invocation criteria remain somewhat ambiguous for similar category, ranking, or broader market-analysis requests.
No suspicious patterns detected.