gzh-subscribe
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches public account article metadata (titles, summaries, and interaction statistics) from the developer's official API endpoint at redfox.hk. This is the core functionality of the skill.
- [COMMAND_EXECUTION]: Uses subprocess.run to interact with system utilities, including opening generated HTML reports in the browser (open or xdg-open) and managing scheduled tasks through launchctl on macOS or crontab on Linux.
- [SAFE]: The persistence mechanism is an optional feature that sets up a local cron job or LaunchAgent to automate report generation at 06:00. This is explicitly documented and requires user activation via the --subscribe command line argument.
- [SAFE]: Secure handling of sensitive API keys is implemented by supporting environment variables or local configuration files (~/.qoder/apis/redfox.json), avoiding hardcoded credentials.
Audit Metadata