xhs-business-validator
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes requests to
api.tikhub.ioto retrieve social media notes and comments for business analysis. This is the intended behavior and uses a well-known third-party service. - [COMMAND_EXECUTION]: The agent is instructed to use
curlfor network requests andpython3 -cfor JSON processing to ensure data integrity when communicating with APIs. - [CREDENTIALS_SAFE]: The skill explicitly forbids hardcoding secrets. It implements a secure workflow that requests the TikHub API token from the user and stores it in a local
.envfile, advising the user to add it to.gitignoreto prevent accidental exposure. - [PROMPT_INJECTION]: The skill processes untrusted content from social media notes and comments (indirect prompt injection surface). While the instructions do not specify sanitization, the risk is addressed by guiding the agent to perform specific structured analysis rather than treating the data as commands.
Audit Metadata