playlet-bili-feed
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to
https://doubaoya.com/api/apis/bilibili/bilibili-playlet-feed/callto fetch short drama video metadata. This network operation is the primary purpose of the skill and is clearly disclosed in the documentation. - [COMMAND_EXECUTION]: The skill executes a local Python script
fetch_playlet_feed.pyusing standard shell commands. The script relies entirely on the Python standard library and contains no logic for arbitrary command execution or system modification. - [CREDENTIALS_UNSAFE]: Authentication is handled via a Bearer token stored in the
DOUBAOYA_API_KEYenvironment variable. This adheres to industry standards for secure secret management in automated scripts and prevents hardcoded credentials. - [PROMPT_INJECTION]: The skill processes external video titles from Bilibili which could potentially contain indirect instructions. However, the risk is minimized as the agent is strictly directed to render this data in a structured table and provide a high-level summary, limiting the impact of any embedded instructions.
Audit Metadata