douyin-content-surge
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to
https://doubaoya.comto fetch video ranking data. This is the primary function of the skill and the destination is consistent with the vendor's documentation. - [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/fetch_content_surge.pyto perform the API requests. The script is transparent, well-documented, and does not use any dynamic code execution or external dependencies. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted data (video titles and categories) from an external source.
- Ingestion points: External data is ingested from the Doubaoya API response in
fetch_content_surge.py. - Boundary markers: None are present in the skill instructions to separate the external content from the agent's logic.
- Capability inventory: The skill has the capability to execute a specific local script and perform network requests to its API endpoint.
- Sanitization: There is no explicit sanitization of the retrieved video metadata before it is formatted into tables for the user.
Audit Metadata