wechat-title
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
fetch_title.pyscript fetches data from the vendor's API athttps://doubaoya.com/api/apis/gongzhonghao/gongzhonghao-coze-cover/callto retrieve viral article titles. - [PROMPT_INJECTION]: The skill processes external data (article titles) retrieved from the remote API. Maliciously crafted titles could potentially influence the agent's behavior during the analysis phase.
- Ingestion points: Article titles returned by the
fetch_title.pyscript from thedoubaoya.comendpoint. - Boundary markers: The instructions in
SKILL.mdlack explicit delimiters or instructions to ignore embedded commands within the retrieved text. - Capability inventory: The skill allows for local script execution and has access to the user's
DOUBAOYA_API_KEY. - Sanitization: No specific filtering or sanitization logic is implemented for the content of the article titles before they are analyzed by the agent.
Audit Metadata