Security audit
Security checks for vulnerabilities and agentic risk
This Shopee category research skill is purpose-aligned and disclosed, but users should understand it uses a Qinghu API token and may consume Qinghu credits after approval.
Install this only if you intend to use Qinghu's Shopee data API. Review which Qinghu token is available in your environment, confirm calls before they are made, and expect possible Qinghu credit usage as described by the skill.
The manifest says the skill 'must trigger' for broad Shopee/category-selection topics and includes a long keyword list, which can cause over-broad activation in ordinary conversations. Over-triggering can route users into a skill that solicits credentials, seeks paid-tool authorization, and initiates external API workflows when the user did not intend that level of access or cost.
The skill explicitly instructs the agent to obtain credentials from environment variables (QINGHU_TOKEN / QHKIT_TOKEN) for a third-party HTTP API. That expands the skill’s access to ambient secrets beyond what the user may have explicitly provided in-chat, creating a risk of unauthorized secret use and unintended data access or billing against the user’s account.
The trigger examples are understandable, but they are open-ended and lack constraints or negative examples distinguishing this skill from broader Shopee advice. Without explicit non-trigger cases, requests like general category questions may collide with this skill unintentionally.
