The Agent Skills Directory

[SAFE]: The skill's primary function is to query the Doubaoya API (doubaoya.com) for Douyin account profiles. This is a legitimate interaction with the vendor's service and does not involve unauthorized data access.
[CREDENTIALS_UNSAFE]: Security best practices are followed for credential management. The DOUBAOYA_API_KEY is retrieved from environment variables, and the skill instructions explicitly forbid the agent from displaying or logging the key to prevent accidental exposure.
[COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/query_account.py) to perform API requests. The script is zero-dependency, uses only standard Python libraries (urllib), and avoids any dynamic code evaluation or unsafe system calls.
[PROMPT_INJECTION]: The skill processes data from an external API (account nicknames). While this creates an indirect prompt injection surface, the risk is mitigated because the skill's logic is restricted to reporting data and providing basic interpretations, with no dangerous downstream capabilities like file writing or secondary command execution based on that data.

douyin-account-insight