xhs-portfolio-search
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary logic is encapsulated in a local Python script (
fetch_xhs_user_works.py) that is executed to fetch and format portfolio data. - [EXTERNAL_DOWNLOADS]: The script communicates with
https://redfox.hk/story/api/xhs/ability/userWorkListto retrieve real-time data. This is the expected functional endpoint for the vendor's service. - [SAFE]: Secret management follows best practices by requiring the
REDFOX_API_KEYto be supplied via an environment variable rather than hardcoding it in the source files. - [SAFE]: No malicious patterns such as obfuscation, unauthorized data exfiltration, or persistence mechanisms were detected. The skill's behavior is consistent with its stated purpose.
Audit Metadata