douyin-comment
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
fetch_comments.pyto retrieve data from the Doubaoya API. This is a standard and safe operation for this skill's purpose. - [EXTERNAL_DOWNLOADS]: The script performs POST requests to
https://doubaoya.com/api/apis/douyin/comments/callto retrieve comment data. This domain is the official endpoint for the service and its use is documented and expected. - [PROMPT_INJECTION]: Indirect Prompt Injection Risk (Category 8):
- Ingestion points: The skill fetches user-generated comment text from Douyin via an external API.
- Boundary markers: There are no explicit instructions or delimiters used to separate the fetched comments from the agent's internal instructions during the analysis phase.
- Capability inventory: The agent is authorized to execute the
fetch_comments.pyscript and process the resulting JSON data. - Sanitization: The skill does not perform sanitization on the fetched comment text before prompting the agent to provide '舆情/选题洞察' (public opinion/topic insights). While this creates a potential surface for indirect injection, it is inherent to the skill's primary function of content analysis.
Audit Metadata