qinghu-shopee-decision
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with the vendor's official domain (
iqinghu.com) to retrieve Shopee market data. - [CREDENTIALS_UNSAFE]: The skill correctly manages authentication by instructing the agent to use environment variables (
QINGHU_TOKEN,QHKIT_TOKEN) or request a token from the user, which is standard practice for API integration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Shopee listings. Ingestion points: External data enters through the JSON-RPC interface at
https://www.iqinghu.com/api/desktop/qh/mcp(SKILL.md). Boundary markers: None explicitly defined. Capability inventory: No local command execution or file-write capabilities detected. Sanitization: Not explicitly described. The lack of dangerous capabilities mitigates the risk from untrusted input.
Audit Metadata