cultural-tourism-bilibili-feed
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the doubaoya.com API endpoint to retrieve video feed data. This behavior is essential to its stated function and uses a legitimate, non-obfuscated domain related to the skill's purpose.
- [COMMAND_EXECUTION]: The skill triggers a local Python script (fetch_culture_feed.py) that uses the standard urllib library. No arbitrary shell commands or external script executions were detected.
- [DATA_EXFILTRATION]: Secure handling of the DOUBAOYA_API_KEY is implemented via environment variables. The skill instructions contain specific directives to the agent to avoid printing or echoing the key, which protects against accidental credential leakage.
- [SAFE]: No evidence of prompt injection, obfuscation, privilege escalation, or persistence mechanisms was found during the analysis of the skill's instructions and script.
Audit Metadata