Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed TikTok product-research workflow that uses paid Qinghu APIs and optional ERP listing with confirmation, with the main caution being default file export for larger datasets.
Before installing, be comfortable providing a Qinghu API token and approving paid tool use. Review the proposed tool list and cost notice before authorizing calls, and explicitly request no local export or no link sharing if you only want an in-chat summary. Confirm any ERP listing links and templates carefully before allowing distribution.
The manifest says the skill 'must trigger' for broad TikTok product-selection and reporting requests, including common adjacent workflows like general product analysis and listing support. This can cause over-selection, routing users into a paid, high-privilege skill when a narrower or safer skill would be more appropriate, increasing the chance of unnecessary tool use, billing, and data access.
The trigger examples are generic requests such as 'give me a TikTok product selection report' or 'analyze products in multiple dimensions,' which overlap with ordinary analysis requests. In context, this skill can invoke multiple paid external tools and downstream listing actions, so ambiguous triggers increase the risk of accidental activation and overbroad execution.
The skill directs the agent to automatically export datasets to local files and share links by default, and to reuse cached local file paths, without requiring explicit user consent for file creation, storage location, retention, or link-sharing scope. This creates a data-handling risk because potentially sensitive commercial data may be written locally and exposed through generated links without the user clearly understanding or approving that behavior.
