wechat-channels-ai-feed
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts exclusively with the domain
doubaoya.comfor its primary data fetching functionality. As this is the vendor's own infrastructure (zizhanovo), this is considered standard operational behavior. - [CREDENTIALS_UNSAFE]: The skill implements secure credential handling by using the
DOUBAOYA_API_KEYenvironment variable. The documentation and scripts contain explicit instructions to never log or expose the secret, and the provided code correctly avoids echoing the key to stdout or stderr. - [COMMAND_EXECUTION]: The skill uses a local Python script to perform API requests. The script (
fetch_sph_ai_feed.py) uses standard Python libraries (urllib) and lacks any dangerous system calls or shell injection vulnerabilities. User-provided keywords are passed as arguments to the script, which handles them safely as JSON-encoded request parameters.
Audit Metadata