skills/peachest/skills/fetch-article/Gen Agent Trust Hub

fetch-article

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses __import__ in scripts/fetch.py to load site-specific adapters (e.g., bilibili, weixin). This is performed safely through a hardcoded mapping function that restricts the imported module names to a fixed set of local files based on the URL domain.
  • [COMMAND_EXECUTION]: Multiple adapters execute external command-line utilities via subprocess.run, including curl for fetching HTML, yt-dlp for YouTube processing, aria2c for Bilibili downloads, and markitdown for Markdown conversion. These are standard tools used for their intended purpose within the skill's scope.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from third-party platforms. It also utilizes r.jina.ai, a well-known reader proxy service, as a fallback mechanism to bypass Cloudflare protection on generic websites. This behavior is clearly documented in the SKILL.md and is used to retrieve article text.
  • [CREDENTIALS_SAFE]: The Zhihu adapter utilizes a local cookie file (~/tmp/zhihu-cookies.txt) to maintain a browser session. This sensitive data is handled locally by Playwright and is not transmitted to any unauthorized third-party servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 10:43 AM