douyin-daily-hot
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script located at
scripts/fetch_daily_hot.py. The script uses Python's standardurlliblibrary to communicate with the vendor's API and does not use unsafe shell execution or external dependencies. - [EXTERNAL_DOWNLOADS]: Communicates with
doubaoya.comto retrieve data. This is the official domain for the tool as described in the documentation and matches the vendor/author context. - [CREDENTIALS_UNSAFE]: Uses the
DOUBAOYA_API_KEYenvironment variable for authentication. The instructions explicitly mandate that the key should not be logged, printed, or returned to the user, which aligns with secure development practices. - [DATA_EXFILTRATION]: While the skill performs network operations, it only sends parameters required for the query (category and date) to the designated vendor endpoint. No sensitive system data is accessed or transmitted.
Audit Metadata