The Agent Skills Directory

[SAFE]: No security issues detected.
[DATA_EXFILTRATION]: The skill handles authentication tokens securely by implementing a redaction mechanism. The _redact function in scripts/kuaishou.py identifies and replaces tokens (access_token, upload_token, etc.) and environment variable values with a <redacted> placeholder before printing logs or errors to the console.
[EXTERNAL_DOWNLOADS]: Media downloads are strictly controlled. The _assert_public_url function implements comprehensive SSRF (Server-Side Request Forgery) protection by verifying URL schemes, matching hostnames against an allowlist of vendor and platform domains (cdn.acedata.cloud, kwimgs.com, etc.), and resolving IP addresses to ensure they are not private, loopback, or reserved addresses.
[COMMAND_EXECUTION]: The skill uses a Bash block in SKILL.md to safely locate the absolute path of its local script. The Python script uses only standard libraries and does not execute arbitrary shell commands on untrusted data.
[REMOTE_CODE_EXECUTION]: All logic is contained within the local scripts/kuaishou.py file, which is executed using the local Python interpreter. There are no patterns of downloading and executing remote scripts or packages.

kuaishou