qinghu-douyin-bluesea-collector

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including Douyin video titles, comments, and hashtag metadata retrieved through tools like douyin_video_search and douyin_hashtag_detail. There are no specific boundary markers or sanitization instructions provided to prevent the agent from potentially interpreting malicious instructions embedded in this external content. The agent maintains network capabilities to communicate with the vendor's API while processing this data.
  • Ingestion points: External data is ingested through the douyin_video_search, douyin_hashtag_detail, and douyin_hashtag_video_list tools as described in SKILL.md.
  • Boundary markers: Absent; the instructions do not specify delimiters or warnings for the agent to ignore embedded instructions in the fetched text.
  • Capability inventory: The skill uses network operations (curl, fetch, requests) to interact with the iqinghu.com API as outlined in SKILL.md.
  • Sanitization: Absent; there is no mention of filtering or escaping external content before analysis.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to the official API endpoint https://www.iqinghu.com/api/desktop/qh/mcp to fetch trending and product data. This is documented as the primary data source for the skill's functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:09 PM