astock-social-feed
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill performs HTTPS POST requests to
doubaoya.comto fetch social media data. It retrieves authentication credentials from theDOUBAOYA_API_KEYenvironment variable, which is a standard and secure practice for secret management. All network operations are directed to the vendor's primary service domain. - [COMMAND_EXECUTION]: The skill executes a local Python script (
fetch_astock_feed.py) using the standardpython3command. The script is self-contained, using only Python's standard library (urllib,json,argparse), and does not invoke subprocesses or execute arbitrary strings as code. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests untrusted content (titles and author names) from social media platforms.
- Ingestion points: Data is fetched from
doubaoya.com/api/apis/multi/cn30-multi-search/calland processed infetch_astock_feed.py. - Boundary markers: None explicitly defined in the instructions to separate external content from agent instructions.
- Capability inventory: The skill only performs data retrieval and formatting; it does not possess file-writing, privilege escalation, or broad shell-execution capabilities.
- Sanitization: Content is handled via standard JSON parsing. Given the lack of dangerous capabilities, this risk is assessed as low and consistent with the skill's primary function.
Audit Metadata