Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Douyin analytics workflow that uses Qinghu APIs with user authorization and billing consent, with manageable cautions around broad activation wording and local data exports.
Before installing, be aware that this skill can send Douyin-related requests and your Qinghu API token to Qinghu, may consume Qinghu credits after you approve tool use, and may create local spreadsheet/cache files for larger datasets. Use it when you want data-backed Douyin analysis, not for generic brainstorming that does not need external data.
The skill metadata says it 'must trigger' for broad, common requests like content planning, topic ideas, and social-media analysis. Overly broad mandatory activation can cause the agent to invoke this skill in contexts where the user did not clearly request external data access, increasing the chance of unnecessary tool use, billing, and exposure of sensitive business context to third-party APIs.
The example triggers include vague everyday requests such as 'give me some topic ideas' and 'make a Douyin content plan' without requiring explicit consent for data-backed tool usage. In this skill, those broad examples are especially risky because the skill is wired to paid external APIs and can prompt unnecessary collection, export, or processing of third-party data when a simpler non-tool response would suffice.
The skill instructs automatic export of datasets to local files and to reuse cached local file paths, while explicitly telling the agent not to ask the user whether export is desired. Writing potentially sensitive analytics data to disk without a clear, contemporaneous user-facing warning or consent creates data-retention and privacy risk, especially in shared or persistent execution environments.
