douyin-realtime-search
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with its declared service endpoint at
doubaoya.com. This represents normal vendor functionality for the search service provided. - [SAFE]: Credential management follows best practices by utilizing the
DOUBAOYA_API_KEYenvironment variable instead of hardcoded secrets. The documentation provides clear warnings against the exposure or improper logging of these keys. - [SAFE]: The included Python script (
scripts/search_realtime.py) is written using only Python standard libraries (urllib,json,os), eliminating risks associated with third-party or unverifiable dependencies. - [DATA_EXPOSURE]: The skill instructions emphasize 'defensive reading' of API responses and mandate that secrets must never be printed or echoed to the user interface.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external content from the Douyin API to generate Markdown tables. While this presents a theoretical surface for indirect injection, the skill employs structured data parsing and is inherent to the primary function of the tool. The risk is considered low given the implementation.
Audit Metadata