multi-content-feed
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
doubaoya.comto fetch content trending data. As this is the official domain for the tool's provider ('zizhanovo'), it is considered a legitimate vendor resource. - [COMMAND_EXECUTION]: The skill uses a Python script to perform API calls via
urllib. The script is executed viapython3with arguments for platforms, keywords, and time ranges. All inputs are parsed safely, and no shell injection vectors were identified. - [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to store their API key in an environment variable (
DOUBAOYA_API_KEY) rather than hardcoding it. The instructions explicitly forbid printing or echoing the key. - [DATA_EXFILTRATION]: Data retrieved from the API is printed to stdout for the agent to process. The script only communicates with the trusted vendor domain
doubaoya.comand does not attempt to send local system data elsewhere. - [PROMPT_INJECTION]: The instructions are clear and focused on data retrieval and presentation. No attempts to override agent safety guidelines or system prompts were detected.
Audit Metadata