playlet-bili-feed

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill connects to https://doubaoya.com/api/apis/bilibili/bilibili-playlet-feed/call to fetch short drama video metadata. This network operation is the primary purpose of the skill and is clearly disclosed in the documentation.
  • [COMMAND_EXECUTION]: The skill executes a local Python script fetch_playlet_feed.py using standard shell commands. The script relies entirely on the Python standard library and contains no logic for arbitrary command execution or system modification.
  • [CREDENTIALS_UNSAFE]: Authentication is handled via a Bearer token stored in the DOUBAOYA_API_KEY environment variable. This adheres to industry standards for secure secret management in automated scripts and prevents hardcoded credentials.
  • [PROMPT_INJECTION]: The skill processes external video titles from Bilibili which could potentially contain indirect instructions. However, the risk is minimized as the agent is strictly directed to render this data in a structured table and provide a high-level summary, limiting the impact of any embedded instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 05:47 PM
Security Audit — agent-trust-hub — playlet-bili-feed