qinghu-1688-goods-detail
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the Node.js runtime environment from nodejs.org and the qhkit package from official npm registries.
- [REMOTE_CODE_EXECUTION]: Outlines a secure installation process for the Node.js runtime, featuring SHA256 integrity verification of the downloaded binary. While automated scanners flagged a command chain as piped to shell, the code specifically pipes to
grepandsha256sumfor validation purposes, following security best practices. - [COMMAND_EXECUTION]: Executes shell commands for environment setup and tool operations, providing specific mitigations for Windows PowerShell character encoding and JSON parsing issues.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied 1688 offer IDs and links for querying the API. It mitigates potential command injection risks by recommending the use of a JSON parameter file (
@params.json) to pass arguments to the qhkit CLI safely.
Audit Metadata