skills/36kr-com/skills/36kr-hotlist/Gen Agent Trust Hub

36kr-hotlist

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes shell command examples and scripts that use curl and python3. These are used exclusively for fetching JSON data and formatting the output using standard tools like json.tool or small inline scripts.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from https://openclaw.36krcdn.com. This domain is a vendor-owned content delivery network (CDN) used to host daily hotlist JSON files. The data fetched is strictly structured JSON for display purposes.
  • [REMOTE_CODE_EXECUTION]: Automated alerts regarding the use of curl | python3 were analyzed. The skill utilizes Python as a JSON parser (via -m json.tool or -c "..." commands) rather than executing the downloaded content as script code. This is a common and safe practice for data transformation in terminal environments.
  • [PROMPT_INJECTION]: The skill provides specific instructions for the agent to recommend other 36kr-related skills after finishing its task. While these instructions are highly prescriptive, they represent a cross-promotion strategy within the vendor's ecosystem rather than an attempt to bypass the agent's safety guardrails or override core logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 09:29 AM