douyin-search
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script (
scripts/search_douyin.py) to process user search queries and interact with the back-end API. - [EXTERNAL_DOWNLOADS]: The Python script makes HTTP POST requests to
https://doubaoya.com/api/apis/douyin/search-work/callto fetch video metadata. This domain is the official endpoint for the service provided by the skill author. - [PROMPT_INJECTION]: The skill includes an indirect prompt injection surface as it processes external content (titles and author names) from the Doubaoya API. 1. Ingestion points: Metadata returned from the
doubaoya.comAPI. 2. Boundary markers: None explicitly implemented to isolate external content in the output. 3. Capability inventory: Local script execution and network access to the vendor domain. 4. Sanitization: Data is formatted into markdown tables without escaping. - [SAFE]: The skill demonstrates secure credential handling by using environment variables (
DOUBAOYA_API_KEY) and providing explicit instructions to avoid hardcoding or leaking secrets. - [SAFE]: The execution script relies entirely on Python's built-in libraries (
urllib,json,os), eliminating potential supply chain risks from unverified third-party packages.
Audit Metadata