douyin-effect-pipeline
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/inspect_douyin_runtime.pyexecutes thepscommand viasubprocess.runto detect running editor processes. This is a legitimate diagnostic function used to prevent project file corruption from multiple writers. The command utilizes a static argument list and does not use a shell, preventing command injection. - [PROMPT_INJECTION]: The skill processes untrusted data from market research, project assets, and application logs. It mitigates indirect injection risks through the use of redaction logic in diagnostic scripts and specific instructions for the agent to label and verify sources as boundary markers. The skill's capabilities are focused on local project maintenance and creation.
- [DATA_EXFILTRATION]: While the skill reads local application logs and project files, it includes a redaction utility in
scripts/inspect_douyin_runtime.pythat specifically filters out sensitive patterns like tokens, cookies, and authorization headers, preventing the accidental exposure of user credentials to the agent or external interfaces.
Audit Metadata