Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/weibo.py) to interact with the Weibo AJAX API viaurllib. All command execution is controlled and scoped to the skill's intended functionality (fetching profile info, listing posts, and creating new posts). - [DATA_EXPOSURE_&_EXFILTRATION]: The skill correctly handles sensitive
WEIBO_COOKIESprovided via environment variables. The Python script includes a domain matching check (_domain_matches) and usesadd_unredirected_headerto ensure cookies are only sent toweibo.comand are not leaked during HTTP redirects. - [REMOTE_CODE_EXECUTION]: No remote code execution was detected. The script is self-contained and uses only the Python standard library (
urllib,json,argparse, etc.). - [PROMPT_INJECTION]: The skill includes explicit instructions for the AI agent to always show a dry-run of a post and obtain user confirmation before applying the
--confirmflag, mitigating the risk of unauthorized actions through the agent.
Audit Metadata