cn-last30days
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/search_cn30.py) to perform API requests. The commands are constructed using predefined arguments and do not incorporate direct, unsanitized user input into shell execution strings. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to
doubaoya.comto fetch social media trends. This is the primary stated purpose of the skill, and the domain matches the skill vendor (zizhanovo/doubaoya). - [CREDENTIALS_UNSAFE]: The skill correctly handles authentication by reading the
DOUBAOYA_API_KEYfrom environment variables rather than hardcoding it or prompting the user to provide it in plain text. It includes explicit instructions never to echo or store the key in files.
Audit Metadata