Security audit
Security checks for vulnerabilities and agentic risk
The skill’s Weibo hot-search purpose is clear, but it also directs automatic software installation, unpinned package use, local PATH changes, and API-token configuration that users should review before installing.
Install only if you are comfortable letting the agent install or upgrade qhkit/Node tooling and configure a Qinghu API token locally. Prefer preinstalling a reviewed, pinned qhkit version yourself, avoid adding PATH changes to shell startup files unless needed, and confirm any paid qhkit call before use.
The markdown explicitly lists 「追热点」 as a trigger, but this phrase is generic and could refer to many kinds of trend-following beyond querying the Weibo hot-search ranking. The file does not provide exclusion conditions or limiting context to reduce unintended invocation collisions.
The skill’s stated purpose is to fetch Weibo hot-search data, but it also instructs the agent to bootstrap the environment by downloading Node.js, globally installing packages, and configuring credentials. That significantly expands the attack surface and grants the skill authority to modify the host environment, turning a simple data-fetch skill into a software installation and configuration workflow.
The skill instructs use of npx @iqinghu/qhkit without pinning an exact version, which makes execution dependent on the latest package version available at runtime. That creates a supply-chain and reproducibility risk: a future compromised or incompatible release could be fetched and executed automatically.
This finding is effectively the same persistent-install behavior duplicated by the scanner. The documented workflow installs binaries under the user home directory and encourages cross-command persistence, which expands the skill’s effect from a single query into durable host modification and creates opportunity for future command hijacking or unintended dependency trust.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This finding is effectively the same persistent-install behavior duplicated by the scanner. The documented workflow installs binaries under the user home directory and encourages cross-command persistence, which expands the skill’s effect from a single query into durable host modification and creates opportunity for future command hijacking or unintended dependency trust.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The instructions direct the agent to use only the domestic iqinghu.com flow and explicitly say not to guide users to the international site unless the user clearly states they use it. This imposes a locale-specific policy and account flow by default rather than offering a user choice or opt-in.
No suspicious patterns detected.