wechat-title

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The fetch_title.py script fetches data from the vendor's API at https://doubaoya.com/api/apis/gongzhonghao/gongzhonghao-coze-cover/call to retrieve viral article titles.
  • [PROMPT_INJECTION]: The skill processes external data (article titles) retrieved from the remote API. Maliciously crafted titles could potentially influence the agent's behavior during the analysis phase.
  • Ingestion points: Article titles returned by the fetch_title.py script from the doubaoya.com endpoint.
  • Boundary markers: The instructions in SKILL.md lack explicit delimiters or instructions to ignore embedded commands within the retrieved text.
  • Capability inventory: The skill allows for local script execution and has access to the user's DOUBAOYA_API_KEY.
  • Sanitization: No specific filtering or sanitization logic is implemented for the content of the article titles before they are analyzed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 11:44 AM
Security Audit — agent-trust-hub — wechat-title