wechat-original-hot
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses an environment variable
DOUBAOYA_API_KEYfor authentication. The instructions explicitly state that the key should not be printed, written to files, or echoed to users, which aligns with security best practices. - [EXTERNAL_DOWNLOADS]: The skill communicates with a single external domain,
doubaoya.com, which is the intended provider for the data requested by the skill. The Python script uses the standardurlliblibrary to make POST requests to the API endpoint. - [COMMAND_EXECUTION]: The skill documentation suggests using shell commands to calculate date offsets (e.g.,
date -d '-9 days'). These are standard utility commands used to format arguments for the Python script and do not present a security risk in this context. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the WeChat Official Accounts API. While it presents this data to the user in a table and provides a 'creative insight', the ingestion point (the API response) is handled by a script that outputs JSON to the AI. The AI then renders this into a table. Standard boundaries apply.
Audit Metadata