Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-built for paid TikTok creator lookups, but it asks agents to install and run unpinned external tooling and persist service credentials on the host.
Review before installing. Use this only if you are comfortable with Qinghu receiving TikTok creator identifiers, with paid credit usage after approval, and with qhkit/Node being installed or updated on the host. Prefer a preinstalled, pinned qhkit version and an ephemeral token supplied through your platform secret mechanism rather than storing long-lived credentials locally.
The skill declares broad mandatory activation conditions for generic requests like creator data or details, increasing the chance of accidental invocation. In this skill, accidental invocation is more dangerous because invocation may lead to paid external calls, installation steps, and credential setup, not just harmless local processing.
The activation section uses vague example phrases without boundaries or exclusions, which can cause over-triggering on normal conversation. Because this skill can incur charges and perform external actions, ambiguous triggering raises the risk of unauthorized calls and unnecessary exposure of user-supplied identifiers to a third-party service.
This read/query skill goes beyond data retrieval and directs the agent to install Node.js and globally install a CLI, modifying the host environment. That expands the blast radius from a simple query into software installation and execution of newly fetched code, which is risky in least-privilege environments and unnecessary for many agent deployments.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, allowing execution of whatever package version is current at invocation time. In an agent setting, this creates supply-chain risk and undermines reproducibility, especially because the package is then used to access external services and potentially handle credentials.
This duplicate finding reflects the same persistent-install behavior: downloading software, extracting it into a user-owned directory, and altering PATH. In the context of an agent skill, this is a risky escalation from data lookup to durable host modification, increasing attack surface and complicating containment.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding reflects the same persistent-install behavior: downloading software, extracting it into a user-owned directory, and altering PATH. In the context of an agent skill, this is a risky escalation from data lookup to durable host modification, increasing attack surface and complicating containment.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs persistent credential configuration via qhkit config set and environment variables, causing the agent to store long-lived secrets on the host. For a single-purpose lookup skill, this exceeds scope and can expose credentials to other processes, later sessions, logs, or unintended reuse across tasks.
No suspicious patterns detected.