qinghu-ozon-hot-product
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill fetches product rankings and market trends from the vendor's official API endpoint at iqinghu.com.
- [SAFE]: The skill provides secure instructions for users to acquire an API key (QINGHU_TOKEN) from the vendor's dashboard and store it in standard environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies an ingestion surface for indirect prompt injection as it processes untrusted retail data (product titles, descriptions, and sales trends) from the Ozon marketplace via the vendor's proxy in SKILL.md. 1. Ingestion points: Product metadata retrieved from https://www.iqinghu.com/api/desktop/qh/mcp. 2. Boundary markers: Absent. 3. Capability inventory: Uses standard HTTP request tools (curl, fetch, requests) and performs local file caching for report generation. 4. Sanitization: There is no instruction to validate or filter external content before analysis.
Audit Metadata