qinghu-amazon-market-assessor
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes structured data from external API endpoints at iqinghu.com. This data ingestion creates a surface for indirect prompt injection if the remote content contains malicious instructions designed to hijack the agent's behavior.
- Ingestion points: Data returned from the Qinghu AI API (https://www.iqinghu.com/api/desktop/qh/mcp) and subsequent parsing of the stringified JSON in the response.
- Boundary markers: The instructions do not define clear boundaries or isolation techniques to prevent the agent from following instructions found within the data.
- Capability inventory: The skill is capable of performing network operations and interacting with file-export tools.
- Sanitization: There is no requirement or instruction for the agent to sanitize or validate the content of the API responses before processing them.
- [EXTERNAL_DOWNLOADS]: The skill performs HTTP requests to www.iqinghu.com to access market research and product data.
Audit Metadata