The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (product titles, descriptions, and rankings) fetched from Shopee and 1688 via a third-party API.
Ingestion points: Data is ingested through the content[0].text field of the JSON response from https://www.iqinghu.com/api/desktop/qh/mcp.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the prompt templates when handling this external data.
Capability inventory: The skill performs network operations to the vendor's API and potentially uses an Excel export tool if available.
Sanitization: There is no explicit mention of sanitizing or escaping the text retrieved from the product listings before it is presented or used for strategy formulation.
[CREDENTIALS_UNSAFE]: The skill requires an API key for authentication. It follows safe practices by instructing the agent to read the key from environment variables (QINGHU_TOKEN, QHKIT_TOKEN) or to request it directly from the user, rather than hardcoding credentials.
[DATA_EXFILTRATION]: The skill communicates with www.iqinghu.com. This domain is the official endpoint for the skill's functionality as indicated by the metadata (ownerId: iqinghu.com). The network operations are limited to this vendor-controlled domain for the purpose of e-commerce data retrieval.

qinghu-shopee-hot-intercept