Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Qinghu e-commerce data and listing assistant, with external API and token use that fit its stated purpose and require user confirmation before tool calls.
Install only if you intend to use Qinghu's e-commerce data and listing workflows. Before approving tool use, check the listed tools, expected credit cost, target platform/account, and whether any action will publish or edit listings.
The skill declares that it 'must trigger' for a very broad set of common e-commerce intents and platform mentions. This can cause the agent to invoke the skill in situations where the user did not explicitly request external data access or tool use, increasing the chance of unnecessary API calls, unintended credential prompts, or inappropriate routing away from safer/default handling.
The example trigger phrases in the '何时触发' section overlap heavily with ordinary user speech, such as asking for product ideas or competitor analysis. In context, this ambiguity is risky because the skill also encourages external API use and token acquisition, so over-triggering can lead to needless data access workflows, extra cost exposure, and user confusion about why a specialized skill was invoked.
