xhs-portfolio-search

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary logic is encapsulated in a local Python script (fetch_xhs_user_works.py) that is executed to fetch and format portfolio data.
  • [EXTERNAL_DOWNLOADS]: The script communicates with https://redfox.hk/story/api/xhs/ability/userWorkList to retrieve real-time data. This is the expected functional endpoint for the vendor's service.
  • [SAFE]: Secret management follows best practices by requiring the REDFOX_API_KEY to be supplied via an environment variable rather than hardcoding it in the source files.
  • [SAFE]: No malicious patterns such as obfuscation, unauthorized data exfiltration, or persistence mechanisms were detected. The skill's behavior is consistent with its stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 02:06 AM
Security Audit — agent-trust-hub — xhs-portfolio-search