Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese-language integration for submitting short-video links to Qinghu's qhkit workflow and exporting paid analytics results.
Before installing, understand that this skill uses Qinghu's qhkit CLI, may install Node/qhkit, sends the video links you provide to Qinghu's service, and requires a Qinghu token for paid workflow execution. Prefer a reviewed or pinned qhkit version if your environment requires strict supply-chain control, and only provide links and credentials you are comfortable using with the Qinghu service.
The activation section uses phrases like '帮我统计这些视频的数据' and '导出视频数据表', which are fairly broad natural-language requests and may overlap with ordinary analytics or spreadsheet-help requests. Although the file names supported platforms elsewhere, this trigger list does not provide negative examples or clear limits on when this skill should not activate.
The instructions mandate Chinese field names and Chinese option values, and state that CLI messages should be relayed in Chinese, but do not offer an opt-in or alternative language path. This can violate language/locale policy when a skill is user-invocable and does not explicitly state that it is limited to Chinese-language operation for a justified regional-only reason.
The skill recommends running npx @iqinghu/qhkit <命令> ... without pinning an exact package version. That allows execution of whatever version is current at install time, which can change behavior unexpectedly or introduce a compromised release into the user's environment.
This duplicate finding describes the same behavior: installing a runtime into a user-controlled directory and prepending it to PATH. That persistence can alter future command resolution and weakens provenance and change control compared with managed installations.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding describes the same behavior: installing a runtime into a user-controlled directory and prepending it to PATH. That persistence can alter future command resolution and weakens provenance and change control compared with managed installations.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"