zhongcao-note-copywriter
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill directs the agent to clone an external repository from GitHub and execute Python scripts (
authorize.py,mcp_client.py). While it uses specific Git commit hashes (313358800e2c5abc992fffb27b6ba66192a771eb) to pin the code, this still involves executing code not contained within the analyzed skill file.\n- [EXTERNAL_DOWNLOADS]: Fetches package contents fromgithub.com/beatra-ai/xiaohongshu-copywriter-skill.gitduring the installation process.\n- [COMMAND_EXECUTION]: Instructs the agent to run shell commands for setup (git clone,git checkout,cp) and operational tasks (python3).\n- [DATA_EXFILTRATION]: Transmits system telemetry (hostname, OS version, CPU architecture, locale) and user-provided marketing briefs to external servers (api.beatra.ai,mcp.beatra.ai). It also mentions a.cnrouting option that sends data through servers in mainland China.\n- [CREDENTIALS_UNSAFE]: The skill manages authentication by storing and reading an OAuth bearer token in a local file at~/.beatra/credentials.json.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted social media data from Xiaohongshu (REDnote), creating a surface for indirect injection attacks.\n - Ingestion points: Processes public social data via
beatra.social.execute(notes, comments, profiles).\n - Boundary markers: None specified in the installation instructions; relies on the agent's internal review of downloaded scripts.\n
- Capability inventory: Shell command execution, network requests to external APIs, and file system access for configuration and credentials.\n
- Sanitization: Not explicitly defined in the pointer; depends on the logic within the external Python scripts.
Audit Metadata