ks-ai-feed
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to
doubaoya.comto fetch video metadata. This is a well-known service related to the skill's purpose and does not involve downloading executable code. - [COMMAND_EXECUTION]: The skill executes a local Python script (
fetch_ks_ai_feed.py) to perform API requests. The script uses standard libraries and does not perform any dangerous system operations. - [CREDENTIALS_UNSAFE]: The skill correctly handles authentication by using the
DOUBAOYA_API_KEYenvironment variable. It includes explicit instructions to avoid logging or exposing this key. - [DATA_EXFILTRATION]: No unauthorized data transmission was detected. The script only sends user-provided keywords to the vendor's API endpoint to retrieve information.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (video titles and author names from Kuaishou). While there is an inherent risk that this data could contain malicious instructions, the skill instructions focus on structured data extraction and clustering, which minimizes the attack surface.
Audit Metadata