Security audit
Security checks for vulnerabilities and agentic risk
The skill’s TikTok shop lookup purpose is coherent, but it directs broad local tool installation and persistent credential setup without clear user-controlled setup boundaries.
Review before installing. Use this skill only if you intend to use the Qinghu qhkit paid data service, and do the Node/qhkit installation and token setup yourself or only after explicit approval. Prefer pinned package versions and avoid storing API tokens in persistent local config unless you are comfortable with later qhkit calls using that credential.
The trigger description is broad enough that the skill may activate on loosely related shopping or competitor-analysis requests. Over-broad invocation increases the chance the agent enters the skill unnecessarily and executes paid external tooling or setup steps the user did not clearly request.
The example triggers list likely intents but does not define clear exclusions, prerequisites, or when not to invoke the skill. In context, this is more dangerous because invocation can lead to paid calls and local environment modification, so accidental triggering has real security and operational cost.
For a read-only shop-product lookup skill, the documentation goes far beyond least privilege by directing installation of Node.js, global packages, PATH changes, and environment bootstrapping. These actions expand the agent's authority and attack surface significantly, enabling persistent system modification unrelated to the narrow user task.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain and reproducibility risk: a later compromised or incompatible release could be fetched and executed in the user's environment.
This duplicated finding identifies the same persistence behavior: installing binaries under the user's home directory and exporting PATH for subsequent use. The danger is context-dependent but elevated here because the persistence is unrelated to the core business function and expands future execution capability on the host.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding identifies the same persistence behavior: installing binaries under the user's home directory and exporting PATH for subsequent use. The danger is context-dependent but elevated here because the persistence is unrelated to the core business function and expands future execution capability on the host.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill tells the agent to set persistent credentials via qhkit config set and environment variables, which alters local authentication state for future sessions. For a simple data retrieval skill, writing tokens into config or environment is excessive and risks credential exposure, misuse across tasks, and unintended cross-session persistence.
No suspicious patterns detected.