Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Shopee data-query integration, but it also tells the agent to install runtimes/packages and configure credentials in the user's environment with broad automatic setup instructions.
Review before installing in a sensitive environment. The skill needs qhkit and a Qinghu API token and may lead the agent to install Node/qhkit, change PATH/profile configuration, and make paid API calls after consent. Prefer using a pre-provisioned, pinned qhkit installation and provide credentials only intentionally.
The description says the skill 'must trigger' for broad natural-language requests about Shopee shop data, which can cause the agent to invoke a paid external tool when the user intent is ambiguous. In this skill, overbroad activation is more dangerous because invocation may lead to software setup, credential prompts, and billable API usage.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## 工具说明（线上原文整理）
通过店铺ID批量获取店铺详情数据。入参 shopIds 由 `queryshopeeshopdata`、`queryshopeeshopranking`、`queryshopeebrandshoplist` 等接口返回。单次最多可传10个店铺ID，多个使用英文逗号分隔。返回每个店铺的销量、销售额、商品数、评分等完整统计数据。可选站点：tw(台湾)、my(马来西亚)、id(印度尼西亚)、th(泰国)、ph(菲律宾)、sg(新加坡)、vn(越南)、br(巴西)。
## 上下游
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## 工具说明（线上原文整理）
通过店铺ID批量获取店铺详情数据。入参 shopIds 由 `queryshopeeshopdata`、`queryshopeeshopranking`、`queryshopeebrandshoplist` 等接口返回。单次最多可传10个店铺ID，多个使用英文逗号分隔。返回每个店铺的销量、销售额、商品数、评分等完整统计数据。可选站点：tw(台湾)、my(马来西亚)、id(印度尼西亚)、th(泰国)、ph(菲律宾)、sg(新加坡)、vn(越南)、br(巴西)。
## 上下游
This documentation goes beyond a narrow shop-detail query and instructs the agent to install software, download runtimes, modify PATH, and configure API credentials. That expansion of scope is dangerous because a simple data-query skill becomes a bootstrapper for environment changes and secret handling, increasing the attack surface if the skill is triggered in a sensitive host environment.
The skill explicitly directs package-manager installs and direct network downloads, including Node.js binaries and mirrors, which are unrelated to answering a shop-detail query. In agent settings, such instructions can induce unreviewed code execution and persistence changes, turning a low-risk data skill into an installer with supply-chain and environment-modification risk.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, so execution behavior can change over time and may pull a compromised or breaking package release at invocation time. In a skill context, this weakens supply-chain integrity because the agent is guided to fetch and run remote code outside a reproducible, reviewed version boundary.
This duplicate finding points to the same persistent installation behavior: extracting binaries into a home directory and modifying PATH. Even with checksum verification, this broadens the skill from data retrieval into environment mutation, which is inappropriate and increases downstream trust and persistence risk.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding points to the same persistent installation behavior: extracting binaries into a home directory and modifying PATH. Even with checksum verification, this broadens the skill from data retrieval into environment mutation, which is inappropriate and increases downstream trust and persistence risk.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
L100 明确要求“不要按国际站引导用户取密钥，也不要拿国际站的模型清单答复”，并要求默认按国内版站点处理，只有用户明确说明国际版账号时才保留 intl。这种默认强制 locale/site 路径的描述未提供用户主动选择机制，属于自然语言层面的 locale 策略限制。
L015-L019 仅给出两个正向示例，但没有说明哪些相似表达不应触发，也没有限定必须具备的上下文要素。对 manifest/markdown 类型文件而言，这会让触发器范围显得模糊，增加误调用风险。
No suspicious patterns detected.