douyin-daily-hot

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script located at scripts/fetch_daily_hot.py. The script uses Python's standard urllib library to communicate with the vendor's API and does not use unsafe shell execution or external dependencies.
  • [EXTERNAL_DOWNLOADS]: Communicates with doubaoya.com to retrieve data. This is the official domain for the tool as described in the documentation and matches the vendor/author context.
  • [CREDENTIALS_UNSAFE]: Uses the DOUBAOYA_API_KEY environment variable for authentication. The instructions explicitly mandate that the key should not be logged, printed, or returned to the user, which aligns with secure development practices.
  • [DATA_EXFILTRATION]: While the skill performs network operations, it only sends parameters required for the query (category and date) to the designated vendor endpoint. No sensitive system data is accessed or transmitted.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 05:47 PM
Security Audit — agent-trust-hub — douyin-daily-hot