qinghu-shopee-category-bluesea
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Shopee market listings and trends retrieved via API, which presents a surface for indirect prompt injection if malicious content is embedded in category names or market descriptions.
- Ingestion points: The skill retrieves dynamic data via tools like
queryshopeelevel3categoriesandqueryshopeecattrendfrom theiqinghu.comAPI as described in SKILL.md. - Boundary markers: There are no specific delimiters or instructions provided to the agent to treat the ingested market data as untrusted content.
- Capability inventory: The skill utilizes network request capabilities (curl, fetch, requests) and invokes various Shopee data tools.
- Sanitization: While the skill validates JSON structure and status codes, it does not specify sanitization or filtering for the textual content received from the API.
Audit Metadata