ClawHub
Back to skill

Security audit

Shopee-店铺每日趋势 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Shopee data-query helper that uses the qhkit CLI and Qinghu credentials, with some install and supply-chain cautions but no evidence of hidden, destructive, or unrelated behavior.

Install only if you are comfortable with qhkit, Node/npm setup, and providing a Qinghu API token. Prefer a preinstalled or pinned qhkit version where possible, review any npm install prompt, and confirm paid Qinghu credit usage before calls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
## 工具说明（线上原文整理）

通过店铺ID查询店铺历史趋势快照。入参 shopId 由 `queryshopeeshopdata`、`queryshopeeshopranking`、`queryshopeebrandshoplist` 等接口返回。按天返回店铺的销量、销售额、商品数、店铺评分等指标。适用于分析某个店铺历史销量趋势场景，最长支持过去720天。如需更精细的颗粒度趋势分析（按月/季度/年聚合），可改用 `queryshopeeshoptrenddetail`。可选站点：tw(台湾)、my(马来西亚)、id(印度尼西亚)、th(泰国)、ph(菲律宾)、sg(新加坡)、vn(越南)、br(巴西)。

## 上下游

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
## 工具说明（线上原文整理）

通过店铺ID查询店铺历史趋势快照。入参 shopId 由 `queryshopeeshopdata`、`queryshopeeshopranking`、`queryshopeebrandshoplist` 等接口返回。按天返回店铺的销量、销售额、商品数、店铺评分等指标。适用于分析某个店铺历史销量趋势场景，最长支持过去720天。如需更精细的颗粒度趋势分析（按月/季度/年聚合），可改用 `queryshopeeshoptrenddetail`。可选站点：tw(台湾)、my(马来西亚)、id(印度尼西亚)、th(泰国)、ph(菲律宾)、sg(新加坡)、vn(越南)、br(巴西)。

## 上下游

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill goes far beyond querying shop trend data by directing the agent to install Node.js, globally install a CLI, configure credentials, and modify the environment. This meaningfully expands the attack surface and grants the skill environment-changing capability unrelated to its narrow business purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which can fetch and execute whatever version is current at runtime. That creates supply-chain and reproducibility risk, especially because this skill also encourages installation and execution of external tooling in the host environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This duplicate finding correctly identifies persistence-related behavior: unpacking software into a user directory and modifying PATH for subsequent command execution. In the context of a data-query skill, such host modification is disproportionate and increases the chance of unsafe long-lived changes.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This duplicate finding correctly identifies persistence-related behavior: unpacking software into a user directory and modifying PATH for subsequent command execution. In the context of a data-query skill, such host modification is disproportionate and increases the chance of unsafe long-lived changes.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instruction says the agent must not guide users to the international site or use its model list, and instead must send the domestic-site key-acquisition wording directly. This imposes a locale/site-specific interaction path and wording without offering the user a language or locale choice, which matches the policy concern for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.