toutiao
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages Toutiao articles using user-provided cookies via the platform's standard BYOC mechanism.
- [EXTERNAL_DOWNLOADS]: The skill fetches external images to re-host them on Toutiao's CDN, incorporating a security check to prevent Server-Side Request Forgery (SSRF) against private networks by resolving hostnames and checking against private IP ranges.
- [COMMAND_EXECUTION]: Operations are performed by a self-contained Python script (
scripts/toutiao.py) using only Python standard libraries, invoked via Bash commands in the agent's environment. - [PROMPT_INJECTION]: A static analysis flag for Unicode steganography was investigated and found to be a false positive; the flagged characters (U+2028 and U+2029) are part of a technical comment describing how the script handles different line-break characters to ensure precise HTML parsing.
- [DATA_EXFILTRATION]: Sensitive cookies are handled securely using unredirected HTTP headers (
add_unredirected_header) to prevent accidental leakage to unauthorized domains during HTTP redirects.
Audit Metadata