Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed TikTok influencer-research workflow that uses a Qinghu API token and external data calls with user confirmation, with no hidden execution or persistence found.
Install only if you intend to use Qinghu's TikTok influencer data service. Be aware that the skill can use a Qinghu API key from your environment or one you provide, will make authenticated external API calls after confirmation, and may export larger result sets to a local table file.
The metadata says the skill 'must trigger' for a wide class of TikTok influencer-research requests, creating an overbroad activation surface. Over-triggering can cause the agent to route ordinary conversations into this skill unexpectedly, increasing chances of unnecessary external calls, token use, and unintended data processing.
The example trigger phrases are broad natural-language requests without negative examples or disambiguation rules. This makes accidental activation more likely in benign planning or advisory conversations, which can lead to unnecessary API usage and exposure of external-integration capabilities.
The skill explicitly instructs the agent to obtain secrets from environment variables (QINGHU_TOKEN / QHKIT_TOKEN) even though the user-facing purpose is influencer discovery, not secret management. In an agentic environment, this expands access to credentials beyond explicit user consent and can enable unintended use of ambient secrets for external API calls.
