gzh-subscribe

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches public account article metadata (titles, summaries, and interaction statistics) from the developer's official API endpoint at redfox.hk. This is the core functionality of the skill.
  • [COMMAND_EXECUTION]: Uses subprocess.run to interact with system utilities, including opening generated HTML reports in the browser (open or xdg-open) and managing scheduled tasks through launchctl on macOS or crontab on Linux.
  • [SAFE]: The persistence mechanism is an optional feature that sets up a local cron job or LaunchAgent to automate report generation at 06:00. This is explicitly documented and requires user activation via the --subscribe command line argument.
  • [SAFE]: Secure handling of sensitive API keys is implemented by supporting environment variables or local configuration files (~/.qoder/apis/redfox.json), avoiding hardcoded credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 08:40 AM
Security Audit — agent-trust-hub — gzh-subscribe