qinghu-tiktok-decision
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard networking tools (such as curl, fetch, or requests) to interact with the vendor's API at iqinghu.com. These interactions are standard for the skill's primary function of data retrieval and task execution within the vendor's ecosystem.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from TikTok and 1688 to generate reports. It mitigates potential risks from untrusted data by instructing the agent to summarize findings and provide conclusions rather than directly outputting raw third-party content into the prompt context.\n
- Ingestion points: Market data enters the agent's context through tools like tiktok_product_ranklist, tiktok_video_ranklist, and 1688goods_image_search_global (SKILL.md).\n
- Boundary markers: The instructions explicitly command the agent to provide judgmental conclusions first and avoid dumping raw fields to the user.\n
- Capability inventory: The skill can perform product listing to external ERP systems (Xiaofeng ERP) and export data files using authorized tools (qinghu-excel-export).\n
- Sanitization: The skill mandates summarization and structured reporting to interpret external data before presentation, which acts as a filter against direct injection attempts embedded in source data.
Audit Metadata