36kr-hotlist
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell command examples and scripts that use
curlandpython3. These are used exclusively for fetching JSON data and formatting the output using standard tools likejson.toolor small inline scripts. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
https://openclaw.36krcdn.com. This domain is a vendor-owned content delivery network (CDN) used to host daily hotlist JSON files. The data fetched is strictly structured JSON for display purposes. - [REMOTE_CODE_EXECUTION]: Automated alerts regarding the use of
curl | python3were analyzed. The skill utilizes Python as a JSON parser (via-m json.toolor-c "..."commands) rather than executing the downloaded content as script code. This is a common and safe practice for data transformation in terminal environments. - [PROMPT_INJECTION]: The skill provides specific instructions for the agent to recommend other 36kr-related skills after finishing its task. While these instructions are highly prescriptive, they represent a cross-promotion strategy within the vendor's ecosystem rather than an attempt to bypass the agent's safety guardrails or override core logic.
Audit Metadata