Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the described TikTok Shop creator lookup, but it also tells the agent to install or upgrade tooling, change PATH, and store API credentials with limited user control.
Install only if you are comfortable with the agent provisioning Node/qhkit, changing local configuration, and storing a qhkit API token. Prefer using a preinstalled, pinned qhkit version in an isolated environment, and require explicit approval before any install, upgrade, token configuration, or paid data call.
The rule '或提出同类需求时必须触发' is overly expansive and effectively delegates invocation scope to interpretation, which can force this skill into many loosely related conversations. Because the skill can lead to paid calls and environment-changing setup instructions, over-triggering materially increases operational and security risk.
The skill metadata contains aggressive invocation language and keyword stuffing that appear designed to maximize triggering rather than narrowly describe capability. In an agent ecosystem, metadata poisoning is dangerous because routing logic may treat manifest text as trusted, leading to unauthorized tool selection, unnecessary paid calls, or execution of risky setup steps.
---
name: qinghu-tiktok-shop-creators
description: "青虎AI TikTok-店铺带货达人：按 seller_id 查询为该店铺带货的达人列表。当用户说「这家店找了哪些达人带货」「竞店合作的达人」「店铺达人矩阵」或提出同类需求时必须触发。关键词：青虎AI、qhkit、青虎数据、TikTok、TikTok Shop、抖音国际版、店铺达人、竞店达人、达人合作、店铺关联带货达人列表。"
user-invocable: true
homepage: https://www.npmjs.com/package/@iqinghu/qhkit
metadata: {"openclaw":{"emoji":"🧑🤝🧑","requires":{"bins":["qhkit"]},"install":[{"kind":"node","
The rule '或提出同类需求时必须触发' is overly expansive and effectively delegates invocation scope to interpretation, which can force this skill into many loosely related conversations. Because the skill can lead to paid calls and environment-changing setup instructions, over-triggering materially increases operational and security risk.
The skill goes far beyond querying creator data and instructs the agent to install Node, install packages globally, set credentials, modify environment variables, and alter local configuration. For a data lookup skill, these are high-risk side effects that can change the host environment, persist secrets, and expand the attack surface unnecessarily.
The skill recommends executing npx @iqinghu/qhkit without pinning a specific version, which allows whatever package version is current at execution time to run. In an agent context, that weakens supply-chain integrity and can unexpectedly introduce new behavior or malicious code if the package or dependency chain is compromised.
This duplicate persistence finding reflects the same risky behavior: extracting Node into a user-controlled directory and exporting a new PATH. In agent-operated environments, even session-scoped path manipulation can influence future tool execution and may combine with other package-install steps to create a broader compromise window.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicate persistence finding reflects the same risky behavior: extracting Node into a user-controlled directory and exporting a new PATH. In agent-operated environments, even session-scoped path manipulation can influence future tool execution and may combine with other package-install steps to create a broader compromise window.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill tells the agent to read and use a local result file for large outputs without any guidance on safe file handling, retention, or privacy boundaries. While not inherently malicious, this can expose sensitive business data or lead the agent to process unintended local files if path handling is not tightly constrained.
No suspicious patterns detected.