Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Shopee market-research workflow that uses a Qinghu API token and exports report data, with no evidence of hidden execution, persistence, or destructive behavior.
Install only if you intend to use Qinghu's Shopee data service. Expect the agent to use a Qinghu API key from QINGHU_TOKEN/QHKIT_TOKEN or one you provide, make paid API calls after confirmation, and create local exported report files for larger datasets; clean up exported files if they contain sensitive business data.
The skill explicitly instructs the agent to read API credentials from environment variables (QINGHU_TOKEN / QHKIT_TOKEN) or ask the user, but it does not include a clear user-facing warning or consent step before accessing locally available secrets. In an agent setting, this increases the risk of silent credential retrieval and unintended transmission of secrets to a third-party endpoint.
The skill says large result sets should be exported by default and that cached local file paths should be reused, but it does not clearly warn the user that files may be written to disk or that local cached data will persist and be referenced later. This can create unintended local data retention, exposure of sensitive business data through file artifacts, and unsafe reuse of filesystem paths in later steps.
