xiaoyuzhou-download
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocess.runfunction to invoke the system'scurlutility for fetching webpage content and downloading audio files. The implementation is secure as it uses a list for command arguments, effectively preventing shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill downloads
.m4aaudio files fromxiaoyuzhoufm.combased on user-provided episode links. This is the primary intended function of the skill and targets the expected service domain. - [SAFE]: Filename generation includes robust sanitization via the
safe_filenamefunction, which removes characters like/,:, and*to prevent directory traversal. The script also validates that input URLs contain the expected domain string before performing network operations.
Audit Metadata