multi-banned-words
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with an external domain
doubaoya.comto perform text analysis. - Evidence: The
scripts/check_multi.pyscript definesAPI_URL = "https://doubaoya.com/api/apis/tool/check-banned-words/call"and usesurllib.requestto send user content to this endpoint. - [PROMPT_INJECTION]: The skill contains instructions to pass through a
noticefield from the API response directly to the user, which could be used to inject instructions or deceptive content from the remote service. - Ingestion points: The
noticefield in the JSON response fromdoubaoya.com(documented inSKILL.md). - Boundary markers: Absent; the skill is instructed to relay the text "as-is".
- Capability inventory: HTTP POST operations via
urllib.requestinscripts/check_multi.py. - Sanitization: Absent; the instructions specify the field should be transferred without modification.
Audit Metadata