qinghu-douyin-bluesea-collector
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including Douyin video titles, comments, and hashtag metadata retrieved through tools like
douyin_video_searchanddouyin_hashtag_detail. There are no specific boundary markers or sanitization instructions provided to prevent the agent from potentially interpreting malicious instructions embedded in this external content. The agent maintains network capabilities to communicate with the vendor's API while processing this data. - Ingestion points: External data is ingested through the
douyin_video_search,douyin_hashtag_detail, anddouyin_hashtag_video_listtools as described inSKILL.md. - Boundary markers: Absent; the instructions do not specify delimiters or warnings for the agent to ignore embedded instructions in the fetched text.
- Capability inventory: The skill uses network operations (
curl,fetch,requests) to interact with theiqinghu.comAPI as outlined inSKILL.md. - Sanitization: Absent; there is no mention of filtering or escaping external content before analysis.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the official API endpoint
https://www.iqinghu.com/api/desktop/qh/mcpto fetch trending and product data. This is documented as the primary data source for the skill's functionality.
Audit Metadata