douban-skill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The python export script (
scripts/douban-frodo-export.py) contains a hardcoded publicAPI_KEY(0dad551ec0f84ed02907ff5c42e8ec70) and an HMAC secret (bf7dddc7c9cfe6f7). As noted in the source documentation, these are static, generic keys compiled within the public Douban mobile application APK used across all installations to establish API parity and sign requests, rather than specific or private user credentials. - [COMMAND_EXECUTION]: The skill requires local execution of Python and Node.js wrapper scripts (
python3 scripts/douban-frodo-export.pyandnode scripts/douban-rss-sync.mjs) to download historical and incremental updates respectively. These scripts only process file writes to standard workspace directories (~/Downloads) and make simple network connections over SSL using native standard library constructs (urllib.request,node:https) with no external runtime dependencies. - [SAFE]: No unexpected behaviors, prompt injection attempts, or hidden code streams were identified across any of the files.
Audit Metadata