douyin-weekly-surge
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script,
scripts/fetch_weekly_surge.py, which uses the Python standard library (urllib) to process requests. - [EXTERNAL_DOWNLOADS]: The skill retrieves trending data from
doubaoya.com. This is the primary function of the tool and is handled via standard HTTPS requests. - [CREDENTIALS_UNSAFE]: The skill implements secure credential management by requiring an environment variable (
DOUBAOYA_API_KEY) and includes explicit 'Iron Rules' to ensure the agent does not print, log, or echo the key back to the user. - [PROMPT_INJECTION]: The skill processes external content (video titles and descriptions) from the Doubaoya API, which creates a theoretical surface for indirect prompt injection. However, the skill's workflow is limited to formatting data into tables and providing textual insights, which is standard for this type of utility.
Audit Metadata