douyin-content-surge
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill communicates exclusively with the vendor's official API domain (
redfox.hk) to retrieve ranking data. Authentication is handled securely via theREDFOX_API_KEYenvironment variable, ensuring no hardcoded credentials are present in the source code. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests third-party data from Douyin via the RedFox API. However, the
douyin_daily_increment.pyscript mitigates this by sanitizing theaweme_desc(title) field, escaping characters like|,[, and]that could be used to manipulate Markdown rendering. - Ingestion points: API response data processed in
douyin_daily_increment.py. - Boundary markers: Data is isolated within a structured Markdown table.
- Capability inventory: Limited to network requests to the vendor's API and standard output formatting.
- Sanitization: Explicit replacement of Markdown-sensitive characters in the Python script.
- [COMMAND_EXECUTION]: No dangerous or unauthorized shell command execution was detected. The skill's operations are confined to standard Python library functions for HTTP requests and text processing.
Audit Metadata