ClawHub
Back to skill

Security audit

TikTok-达人筛选库 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate TikTok creator-search skill, but it can install or upgrade local tooling and change qhkit credential/config settings, so it should be reviewed before use.

Install only if you are comfortable with the agent installing or upgrading qhkit/Node and configuring a qhkit token for a paid external service. Prefer a preinstalled, pinned qhkit version and review any credential or PATH changes before allowing setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (8)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: qinghu-tiktok-creator-search
description: "青虎AI TikTok-达人筛选库：从 TikTok 达人库（T+1 更新）按站点、粉丝数、互动率、带货类目、性别、语言等条件批量筛选达人。当用户说「找美国站粉丝 1 万以上的美妆达人」「筛一批互动率高的带货达人」「按类目找达人建联」或提出同类需求时必须触发。关键词：青虎AI、qhkit、青虎数据、TikTok、TikTok Shop、抖音国际版、达人筛选、找达人、达人库、KOL、网红营销、达人列表。"
user-invocable: true
homepage: https://www.npmjs.com/package/@iqinghu/qhkit
metada

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text says the skill 'must' activate for similar requests and includes broad keyword coverage, which can cause overbroad invocation on loosely related user prompts. Over-triggering is dangerous here because this skill also contains installation and credential-handling instructions, so accidental activation could lead to unnecessary risky operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation guidance provides positive examples but lacks negative examples or clear boundaries, leaving the scope underspecified. Ambiguous routing increases the chance that the agent invokes this skill for adjacent marketing or analytics tasks, which is riskier because the skill can install software and manipulate configuration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill contains extensive environment bootstrap and software installation steps unrelated to merely searching TikTok creators, including downloading Node, installing packages globally, and altering the runtime environment. This broadens the skill from data retrieval into host modification, increasing attack surface and creating opportunities for persistence, unsafe installs, and execution of unnecessary external code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs use of an unpinned package via npx @iqinghu/qhkit, which allows whatever version is current at execution time to be fetched and run. That creates a supply-chain risk: behavior can change unexpectedly, and a compromised or malicious upstream release would execute in the agent context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This duplicate finding points to the same persistence behavior: unpacking software into the user's home directory and exporting a modified PATH. Such instructions are inappropriate for the skill's stated purpose and increase the blast radius by leaving behind executable tooling on the host.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This duplicate finding points to the same persistence behavior: unpacking software into the user's home directory and exporting a modified PATH. Such instructions are inappropriate for the skill's stated purpose and increase the blast radius by leaving behind executable tooling on the host.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to read and modify host credential configuration, including setting tokens and using environment variables. For a creator-search skill, this exceeds least privilege and may expose, overwrite, or misuse sensitive credentials from the host environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.