yichen-content-archive

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module across multiple files (douyin_download.py, firecrawl_site.py, known_media_download.py, weibo_known_url.py, youtube_known_url.py, xiaoyuzhou_opencli.py, xiaoyuzhou_stepfun.py) to execute command-line tools including yt-dlp, playwright, ffprobe, and opencli for media processing and site archiving.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external URLs (social media posts, web articles).
  • Ingestion points: Multiple scripts (douyin_download.py, xiaohongshu_fetch.py, weibo_known_url.py, x_known_url.py, youtube_known_url.py, firecrawl_site.py) fetch HTML, metadata, and media from platforms like Weibo, X, Xiaohongshu, Douyin, and YouTube.
  • Boundary markers: The instructions in SKILL.md include defensive rules to limit the agent's scope to explicit URLs and bounded site Map/Crawl operations, explicitly forbidding open-ended discovery.
  • Capability inventory: The skill has file system write access for archiving and network access to fetch content, and it executes external CLI tools via subprocesses.
  • Sanitization: Scripts include logic to filter and project content into structured metadata, and weibo_known_url.py implements a sanitized_error function to redact potentially sensitive URLs or secrets from logs.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content, media, and configuration from external domains, including api.firecrawl.dev, douyin.com, xiaohongshu.com, api.fxtwitter.com, r.jina.ai, and xyzcdn.net. These operations are integral to the skill's functionality for content archiving.
  • [DYNAMIC_EXECUTION]: The script known_media_download.py uses importlib.util to dynamically load and execute the local x_known_url.py script. This is used for internal modularization within the skill package.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 12:43 AM