dailyhot-api
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the dailyhot-api package from the official NPM registry to provide its core API functionality.\n- [COMMAND_EXECUTION]: Utilizes shell and Python scripts to install dependencies, manage a background Node.js process, and aggregate platform data. The scripts use standard utilities like curl, kill, and npm for service lifecycle management.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes live trending titles and descriptions from over 40 external sources. While this is the intended purpose, it creates a surface for untrusted content to enter the agent context.\n
- Ingestion points: Fetches real-time data from external platform endpoints via the local DailyHotApi instance.\n
- Boundary markers: None implemented in the aggregation scripts to delimit external content.\n
- Capability inventory: Includes file system writing (via output flags), network requests to localhost, and local process management.\n
- Sanitization: The collection script filters data based on keywords but does not perform sanitization for embedded prompt injection patterns.
Audit Metadata