Security audit
Security checks for vulnerabilities and agentic risk
The skill is for TikTok Shop review lookups, but it also directs the agent to install tools, change the local environment, and configure API credentials, which deserves user review before installation.
Install only if you are comfortable letting the skill use qhkit for paid TikTok Shop review lookups and you can review setup steps before they run. Prefer a preinstalled, pinned qhkit version, avoid automatic global installs or shell-profile changes, and provide the Qinghu token only when you trust the vendor account and understand the credit charges.
The manifest description says the skill 'must trigger' when the user says phrases like '买家怎么评价这款' or '商品差评', which are broad natural-language requests that could arise in many contexts. It does not clearly limit activation to cases where a TikTok Shop product_id is available or provide exclusion conditions, increasing the risk of unintended invocation.
The examples include generic phrases such as '看看这个 TikTok 商品的评论' and '商品差评', but the document does not specify when these should not trigger or what minimum context is required. Without explicit constraints, the activation logic is underspecified for a user-invocable skill.
The skill goes beyond its stated purpose of fetching TikTok product reviews and instructs the agent to bootstrap Node.js, install a global CLI, configure credentials, and modify the execution environment. This materially expands the attack surface by encouraging network downloads, package installation, credential handling, and system changes from within a content skill rather than relying on preinstalled, trusted platform capabilities.
The skill instructs the agent to execute npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to run arbitrary install-time and runtime code. In the context of an agent skill, this creates a supply-chain risk and reduces reproducibility, especially because the package is then trusted to handle credentials and external data access.
This duplicate finding identifies the same persistence behavior: unpacking a runtime into a user-controlled directory and exporting a new PATH. Even with checksum verification, the persistence itself is unsafe in a skill because it normalizes system modification for a data-retrieval task and creates durable trust in newly introduced executables.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate finding identifies the same persistence behavior: unpacking a runtime into a user-controlled directory and exporting a new PATH. Even with checksum verification, the persistence itself is unsafe in a skill because it normalizes system modification for a data-retrieval task and creates durable trust in newly introduced executables.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill is written entirely in Chinese and includes prescriptive Chinese user-facing text and output templates, but nowhere offers the user a choice of language or notes that Chinese is optional. This can violate language/locale policy when a skill imposes a specific language without opt-in.
No suspicious patterns detected.