fetch-article
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses
__import__inscripts/fetch.pyto load site-specific adapters (e.g., bilibili, weixin). This is performed safely through a hardcoded mapping function that restricts the imported module names to a fixed set of local files based on the URL domain. - [COMMAND_EXECUTION]: Multiple adapters execute external command-line utilities via
subprocess.run, includingcurlfor fetching HTML,yt-dlpfor YouTube processing,aria2cfor Bilibili downloads, andmarkitdownfor Markdown conversion. These are standard tools used for their intended purpose within the skill's scope. - [EXTERNAL_DOWNLOADS]: The skill fetches content from third-party platforms. It also utilizes
r.jina.ai, a well-known reader proxy service, as a fallback mechanism to bypass Cloudflare protection on generic websites. This behavior is clearly documented in the SKILL.md and is used to retrieve article text. - [CREDENTIALS_SAFE]: The Zhihu adapter utilizes a local cookie file (
~/tmp/zhihu-cookies.txt) to maintain a browser session. This sensitive data is handled locally by Playwright and is not transmitted to any unauthorized third-party servers.
Audit Metadata