cultural-tourism-wechat-feed
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to
doubaoya.comto fetch WeChat article data. This is an expected operation for the skill's stated purpose of providing an article feed. The connection uses HTTPS and targeted headers. - [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to provide an API key via the
DOUBAOYA_API_KEYenvironment variable. The instructions and the script explicitly avoid printing or echoing this key, which is a recognized safe practice for secret management. - [COMMAND_EXECUTION]: The skill executes a Python script
fetch_culture_feed.pyto handle API requests. The script uses standard libraries and processes arguments safely throughargparsewithout using dangerous functions likeshell=Trueoros.system()with unsanitized user input. - [DATA_EXFILTRATION]: No evidence of data exfiltration was found. Network operations are limited to the vendor's API domain (
doubaoya.com), and no sensitive local files (like SSH keys or AWS configs) are accessed or transmitted.
Audit Metadata