ClawHub
Back to skill

Security audit

Shopee-店铺榜单 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Shopee shop-ranking purpose is coherent, but it tells the agent to install and update unpinned external tooling and make persistent local configuration changes, so it should be reviewed before use.

Install only if you are comfortable letting this skill add or update Node/npm tooling and qhkit on the machine, store a qhkit token, and possibly change qhkit configuration. Prefer a preinstalled, pinned qhkit version and approve paid qhkit calls only after the tool name, purpose, and estimated credits are shown.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L003 写明“当用户说……或提出同类需求时必须触发”，其中“同类需求”没有边界、排除条件或负例，触发范围不清晰。该描述会把大量泛化的 Shopee 店铺查询表述都纳入触发条件，增加非预期调用此技能的风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

L018-L019 的“最近飙升的店铺”“店铺月榜”都是简短泛化表达，没有限定必须是 Shopee、店铺榜单、类目查询等上下文。用户在更广泛的电商分析或闲聊场景中使用类似措辞时，可能错误激活该技能。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill goes far beyond using an existing tool and instructs the agent to install Node.js, globally install packages, set configuration, and modify the host environment. This materially increases attack surface and violates least-privilege expectations for a data-query skill, because executing these steps would run third-party code and persist changes on the system.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to run in the host environment. That creates a supply-chain risk and makes behavior non-reproducible; if the package is updated maliciously or incompatibly, the agent could execute unreviewed code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This duplicate finding points to the same session-persistence behavior: unpacking software into the home directory and modifying PATH for future command resolution. In context, that is riskier because the skill is nominally for data retrieval but embeds operational guidance that changes the system state and may affect subsequent sessions or tools.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This duplicate finding points to the same session-persistence behavior: unpacking software into the home directory and modifying PATH for future command resolution. In context, that is riskier because the skill is nominally for data retrieval but embeds operational guidance that changes the system state and may affect subsequent sessions or tools.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Static analysis

No suspicious patterns detected.