qinghu-white-background
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Node.js runtime from its official domain to ensure the environment meets version requirements.
- Evidence:
curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xzinSKILL.md. - Evidence:
curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txtused for verification. - Note: The download targets a well-known, trusted service and includes a checksum verification step to ensure file integrity.
- [COMMAND_EXECUTION]: The skill contains logic to bootstrap its own environment by executing shell commands for dependency installation and verification.
- Evidence:
tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib". - Evidence: Usage of
sha256sum -c -to validate remote content before execution. - [EXTERNAL_DOWNLOADS]: The skill installs its primary CLI dependency from the NPM registry or a well-known mirror.
- Evidence:
npm i -g @iqinghu/qhkitwhich is the official package for the service. - Evidence: Fallback to
https://registry.npmmirror.com(Alibaba Cloud mirror) for reliability. - [PERSISTENCE]: The instructions suggest persisting the newly installed Node.js binary path in the user's shell configuration file.
- Evidence: Instruction to append
export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"to~/.bashrc. - Note: This is a standard environment configuration practice for non-standard binary locations and is necessary for the tool's continued functionality.
Audit Metadata