douyin-hot-trend
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate operations to fetch and display trending data from the vendor's API (redfox.hk). It includes a multi-level fallback mechanism for API key retrieval (environment variables and shell configuration files), which is a common pattern for developer-oriented tools and does not constitute unauthorized data access in this context.
- [COMMAND_EXECUTION]: The skill executes local Python scripts,
hotspot_fetcher.pyandgen_douyin_hot_html.py, to perform its core functions. These scripts are invoked to communicate with the API and render data into HTML/PDF reports, operating within the intended boundaries of the skill environment. - [PROMPT_INJECTION]: The skill ingests untrusted data from Douyin trending topics. This creates an indirect prompt injection surface where malicious instructions could theoretically be embedded in topic titles. However, the skill only uses this data for display and text-based analysis, significantly limiting the risk of exploitation. No dangerous interpolation into executable contexts was observed.
Audit Metadata