qinghu-white-background

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Node.js runtime from its official domain to ensure the environment meets version requirements.
  • Evidence: curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz in SKILL.md.
  • Evidence: curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt used for verification.
  • Note: The download targets a well-known, trusted service and includes a checksum verification step to ensure file integrity.
  • [COMMAND_EXECUTION]: The skill contains logic to bootstrap its own environment by executing shell commands for dependency installation and verification.
  • Evidence: tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib".
  • Evidence: Usage of sha256sum -c - to validate remote content before execution.
  • [EXTERNAL_DOWNLOADS]: The skill installs its primary CLI dependency from the NPM registry or a well-known mirror.
  • Evidence: npm i -g @iqinghu/qhkit which is the official package for the service.
  • Evidence: Fallback to https://registry.npmmirror.com (Alibaba Cloud mirror) for reliability.
  • [PERSISTENCE]: The instructions suggest persisting the newly installed Node.js binary path in the user's shell configuration file.
  • Evidence: Instruction to append export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH" to ~/.bashrc.
  • Note: This is a standard environment configuration practice for non-standard binary locations and is necessary for the tool's continued functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:09 PM