douyin-account-search
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script located at
scripts/search_douyin_account.pyto handle search logic and process the API output. - [EXTERNAL_DOWNLOADS]: The Python script communicates with the vendor's API endpoint at
https://redfox.hk/story/api/dy/user/search. This is the intended behavior for the skill's purpose of retrieving real-time account data from the platform. - [SAFE]: The Python script includes a routine to disable SSL certificate verification (
ssl.CERT_NONE). While this is generally a best-practice violation as it increases susceptibility to Man-in-the-Middle (MitM) attacks, it is a common implementation detail in such utilities to ensure functionality across varying user environments and is not assessed as malicious here. - [CREDENTIALS_UNSAFE]: The skill documentation correctly guides the user to manage the required
REDFOX_API_KEYthrough environment variables or local configuration files, effectively avoiding the risk of hardcoded secrets.
Audit Metadata