douyin-realtime-hot-rise
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script optionally attempts to use the
certifiPython package for SSL certificate verification. If not present, it gracefully falls back to the system's default SSL context. This is a standard security best practice for Python network applications. - [COMMAND_EXECUTION]: The skill provides a Python runner script (
scripts/run.py) intended to be executed by the user. The script performs structured HTTP POST requests to the skill's backend atai-skills.ai. No arbitrary or dangerous command execution was found. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided search keywords and tags which are passed to an external API. While this constitutes an ingestion point for untrusted data, the data is handled as structured JSON parameters for a specific API endpoint rather than being directly interpolated into an LLM prompt, minimizing the risk of injection attacks.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to provide their API key via an environment variable (
AISKILLS_API_KEY), which is a secure and standard practice compared to hardcoding secrets.
Audit Metadata