qc-plan-monitor
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a shell launcher (
run) and a Windows batch script (run.cmd) to execute a local binary (ocean-watch-launcher). This is a standard pattern for skills that bridge an AI agent with specialized local tools. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data from Douyin share links and URLs to resolve creative materials.
- Ingestion points: External URLs are passed as arguments to the
qc-materials inspect-workandplans batch-qianchuan-workscommands, as detailed inreferences/workflow-reference.md. - Boundary markers: The skill documentation explicitly categorizes data from external tools like F2 as 'untrusted public identity hints,' requiring the agent to verify all information against official APIs before taking action.
- Capability inventory: The skill has the capability to execute a local binary and perform network operations to official ByteDance/Qianchuan API endpoints.
- Sanitization: Security measures include domain allow-listing for redirects (restricting to
douyin.comandiesdouyin.com), URL normalization, and mandatory cross-referencing of public identifiers with official account data.
Audit Metadata