Security audit
Security checks for vulnerabilities and agentic risk
This skill is a focused Ozon keyword-analysis helper that uses a disclosed Qinghu API token and may export large results to files, with no evidence of hidden execution or malicious behavior.
Install only if you intend to use Qinghu's Ozon data APIs. Configure the Qinghu token deliberately, expect external API calls and possible Qinghu credit charges after confirmation, and be aware that larger result sets may be exported to local spreadsheet files or links by default.
The description says the skill 'must trigger' whenever the user mentions a broad set of Ozon keyword-analysis concepts. Overly broad mandatory triggers can cause unintended invocation, leading to unnecessary external API calls, data export, credential prompts, or charges in conversations where the user did not actually request this specific skill.
The skill explicitly instructs the agent to read API credentials from environment variables (QINGHU_TOKEN / QHKIT_TOKEN) even though the user-facing task is keyword and product analysis. In a skill execution environment, this creates a data-access path from ambient secrets to an external third-party API and exceeds what is strictly necessary unless the platform has an explicit secret-scoping model and the user has knowingly authorized that credential use.
The skill instructs the agent to automatically export datasets of 10+ records and to rely on cached local file paths, without a clear user-facing warning about local data handling, retention, or exposure. This can cause potentially sensitive commercial analysis data to be written to local storage or shared via links by default, increasing the risk of unintended persistence or disclosure.
