overseas-trending-search
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/digest.pyusessubprocess.runto open the generated HTML report in a browser. The implementation uses a list of arguments withoutshell=True, which is a secure method for invoking system utilities. - [EXTERNAL_DOWNLOADS]: The skill communicates with the RedFox API (
redfox.hk) to retrieve social media data. This activity is consistent with the skill's primary function and uses the vendor's own infrastructure. - [CREDENTIALS_UNSAFE]: The skill implements standard practices for API key management, supporting environment variables (
REDFOX_API_KEY) and a local JSON configuration file (~/.qoder/apis/redfox.json), avoiding hardcoded secrets. - [PROMPT_INJECTION]: The skill processes untrusted content from social media platforms. The risk of indirect prompt injection is mitigated by storing data in a structured JSON format within the HTML report and applying HTML escaping (via
textContentinreport_template.html) before rendering. The ingestion points are the source-specific API responses, and capabilities include network requests, file writes, and browser execution.
Audit Metadata