xiaohongshu-video-downloader
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the vendor-owned API endpoint at
https://redfox.hk/story/api/parseWork/videoDownload/xhs. This is required for the skill's primary function of parsing video metadata and download links. - [COMMAND_EXECUTION]: The skill executes the included Python script
scripts/downloader.pyto perform API calls and format the output. The script is part of the skill package and handles user input via command-line arguments. - [CREDENTIALS_UNSAFE]: The skill requires a
REDFOX_API_KEY. It supports reading this key from the environment variableREDFOX_API_KEYor a local configuration file at~/.qoder/apis/redfox.json. The implementation includes a security measure to set the configuration file permissions to0o600(read/write by owner only), which aligns with best practices for local secret storage. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (Xiaohongshu video descriptions). To mitigate risks, the script implements strict domain validation, only allowing links from
xiaohongshu.comandxhslink.com. The output is presented to the user/agent as descriptive text and download links.
Audit Metadata