zhihu
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill handles authentication using environment variables (
ZHIHU_DEVELOPER_TOKENandZHIHU_COOKIES) injected by the connector, which is a secure method for managing secrets without hardcoding. - [SAFE]: A strict safety gate is implemented for all write operations (publishing articles, answering questions, or editing content). The scripts require a
--confirmflag to be the final argument, ensuring that the AI agent must perform a dry-run and receive explicit user approval before any changes go live. - [SAFE]: The
blog.pyscript contains domain-validation logic to ensure that sensitive session cookies are only transmitted to authorized Zhihu domains. This protects against credential leakage during operations like image re-hosting from third-party sources. - [SAFE]: The skill uses the Python standard library (
urllib) for all network requests, eliminating risks associated with unverified third-party dependencies or dynamic remote code execution. - [SAFE]: The instructions explicitly direct the agent to keep credentials secret and forbid echoing or printing them, providing clear operational boundaries for safe execution.
Audit Metadata