Security audit
Security checks for vulnerabilities and agentic risk
The skill’s core TikTok product-video lookup is coherent, but it tells agents to install unpinned tooling and configure credentials on the host, which users should review first.
Install only if you trust the qhkit package and Qinghu account workflow. Prefer a pre-provisioned, pinned qhkit version and platform-managed secrets; avoid letting the skill automatically install Node/npm packages or overwrite an existing qhkit token without explicit approval.
The manifest says the skill 'must trigger' when the user says phrases like '找这款的爆款视频' or '看看别人怎么拍这个产品' or makes '同类需求', which is an open-ended condition without clear boundaries. These phrases are common product-marketing requests and the file does not provide exclusion conditions or negative examples to limit when this specific skill should activate.
The activation examples are short natural-language phrases, but they do not clarify whether the skill should trigger only when a product ID is available, only for TikTok product-video lookup, or how to distinguish from general competitor research or content brainstorming. Without constraints or negative examples, the skill may be invoked for adjacent but different user intents.
The skill includes broad environment bootstrapping steps, including installing Node.js and globally installing a CLI, which exceeds the narrow purpose of querying product-video data. This expands the agent's operational scope from read-only data access into host modification and package installation, increasing attack surface and the chance of unintended system changes.
The skill instructs use of npx @iqinghu/qhkit without pinning a version, which allows execution of whatever package version is current at runtime. In a security-sensitive agent context, this creates a supply-chain risk because behavior can change unexpectedly or a compromised upstream release could be pulled and executed automatically.
This duplicated finding reflects the same issue: the skill guides users to install binaries into a user-controlled directory and update PATH, creating persistence beyond the immediate task. For a simple lookup skill, these host modifications are unnecessary and increase the chance of unintended long-term environment changes.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding reflects the same issue: the skill guides users to install binaries into a user-controlled directory and update PATH, creating persistence beyond the immediate task. For a simple lookup skill, these host modifications are unnecessary and increase the chance of unintended long-term environment changes.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill directs the agent to set authentication tokens and modify environment variables or local configuration, which is beyond what is justified for a read-oriented lookup skill. This creates risk of credential mishandling, overwriting existing auth context, or steering the agent into changing persistent trust/config state on the host.
No suspicious patterns detected.