wechat-account-search
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script locally, using keywords extracted from user input as CLI arguments. This is a common pattern for such skills and relies on the agent's ability to sanitize user input to prevent shell-based command injection.
- [EXTERNAL_DOWNLOADS]: The Python script makes POST requests to 'https://redfox.hk/story/api/gzh/ability/searchAccount' to fetch account information. This domain belongs to the skill's vendor and the operation is central to its stated purpose.
- [SAFE]: The search script contains logic to disable SSL certificate verification (
ssl.CERT_NONE). This is generally considered a poor security practice as it increases vulnerability to man-in-the-middle attacks, though it is often used to ensure functionality in restricted network environments.
Audit Metadata