playlet-xiaohongshu-feed
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local Python script
fetch_playlet_feed.pyto retrieve data. This script uses Python's built-inurlliblibrary to make HTTP requests and does not perform any unsafe system calls or process unvalidated user input as shell commands. - [DATA_EXFILTRATION]: Network communication is restricted to
doubaoya.com, which is the declared service provider for this skill's functionality. The skill uses theDOUBAOYA_API_KEYenvironment variable for authentication, ensuring that sensitive credentials are not hardcoded or exposed in logs. - [PROMPT_INJECTION]: The skill processes note titles and metrics from an external source. While this represents a surface for indirect prompt injection, the agent is instructed to use the data for structured reporting (Markdown tables and clustering), which significantly limits the potential for malicious instructions to influence the agent's behavior.
Audit Metadata