qinghu-amazon-trend-hunter
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is configured to access sensitive environment variables (
QINGHU_TOKEN,QHKIT_TOKEN) and transmit them as authentication headers to the vendor's API endpoint athttps://www.iqinghu.com/api/desktop/qh/mcp. This is the documented method for service authentication. - [COMMAND_EXECUTION]: The instructions direct the agent to utilize network utilities such as
curl,fetch, orrequeststo perform JSON-RPC calls against the remote API. - [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it processes external data retrieved from API responses and user-provided keywords.
- Ingestion points: External product data and category information from
iqinghu.comAPI responses. - Boundary markers: The skill relies on the structured nature of JSON-RPC responses for data isolation.
- Capability inventory: Performs network operations via HTTP tools and integrates with external data export utilities.
- Sanitization: Instructs the agent to validate parameters against a defined
inputSchemaand perform two-stage JSON parsing of response content.
Audit Metadata