The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external platforms (Douyin and 1688), which are untrusted sources. This data could potentially be manipulated to include hidden instructions that exploit the agent's capabilities.
Ingestion points: Data is ingested through tools such as douyin_video_search, douyin_video_info_with_play, and 1688goods_detail_global which fetch content from public social media and marketplace platforms.
Boundary markers: No explicit delimiters or "ignore" instructions are provided to the agent to help distinguish between data and instructions when processing fetched content.
Capability inventory: The skill possesses the ability to perform network operations and execute product distribution actions through the Xiaofeng ERP API (xiaofeng_distribute_douyin_links), creating a path from external data to automated store management.
Sanitization: The instructions do not specify validation or sanitization routines for the data fetched from external APIs before it is used to populate listing parameters or presented to the user.
[DATA_EXFILTRATION]: The skill is designed to read sensitive credentials (QINGHU_TOKEN or QHKIT_TOKEN) from environment variables. These tokens are then transmitted in the Authorization header to an external API endpoint at https://www.iqinghu.com/api/desktop/qh/mcp. While this is a requirement for the skill's primary function, it involves the retrieval and network transmission of private access keys.

qinghu-douyin-video-distribute