Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Ozon market-analysis integration, but users should knowingly approve Qinghu API use, token access, costs, and local exports.
Install this only if you want the agent to call Qinghu's API for Ozon category research. Use an approved secret mechanism for the Qinghu token, confirm paid API calls before they run, and remember that larger results may be written to local spreadsheet or cache files.
The description says the skill 'must trigger' whenever a user wants to open an Ozon store, enter a new category, find blue-ocean categories, view growth, or assess saturation. Those intents are broad and could overlap with many ordinary planning conversations, and the file does not give exclusion conditions or clear boundaries for when not to invoke this skill.
The title and the surrounding instructions present the skill as operating in Chinese, and the file does not offer any language or locale choice to the user. A fixed language requirement without opt-in can violate language/locale policy expectations when users may prefer another language.
The skill explicitly instructs the agent to read API credentials from environment variables without requiring explicit user awareness or consent. In an agent environment, this increases the chance of unauthorized secret access and downstream use of credentials the user did not intentionally provide in the current interaction.
The skill mandates automatic export to a local file and reuse of cached local paths without informing the user about file creation or persistence. This can leave potentially sensitive commercial data on disk unexpectedly, creating data retention and local exposure risks in shared or multi-tenant environments.
The '何时触发' section provides examples like asking what category is good on Ozon or which subcategory is unsaturated, but it does not define trigger limits, required context, or examples of similar requests that should not activate the skill. Without those constraints, invocation behavior may be inconsistent or over-inclusive.
