Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed TikTok trend-analysis skill that uses a Qinghu API token and may export larger results locally, with no evidence of hidden code or destructive behavior.
Before installing, be comfortable sharing a Qinghu API token with the agent environment and sending TikTok research queries to Qinghu's API. Expect the skill to ask for approval before API calls and to report Qinghu credit usage, and remember that larger result sets may be exported to local files that you may need to manage or delete.
The skill’s trigger text uses mandatory activation language for broad, common planning requests such as asking for topic ideas or a content calendar. That can cause the agent to invoke this skill in situations where the user did not intend external TikTok/青虎 data access, increasing the chance of unnecessary third-party requests, credential prompting, and billed tool usage.
The skill instructs automatic export of large result sets to a local file and says not to ask the user first. Automatic local file creation can write potentially sensitive or proprietary data to disk without explicit user consent, and the follow-on instruction to reuse cached local file paths increases the risk of unintended data persistence and exposure across later steps.
