wechat-top-account
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill facilitates legitimate data retrieval from doubaoya.com, consistent with its declared purpose of WeChat account tracking.
- [EXTERNAL_DOWNLOADS]: The skill connects to the vendor's API at doubaoya.com to retrieve ranking data. This connection is necessary for the skill's function and targets the official service domain.
- [DATA_EXPOSURE_AND_EXFILTRATION]: Authentication is handled via the environment variable DOUBAOYA_API_KEY. The skill instructions include explicit guidelines to prevent the AI agent from leaking or exposing these credentials in its responses, adhering to secure secret management practices.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Doubaoya API. Ingestion point: API response output from scripts/fetch_index_rank.py. Boundaries: The instructions define specific fields for extraction (rank, accountName, indexScore). Capability inventory: The agent executes the data-fetching script and renders a Markdown table. Sanitization: The skill uses structured JSON parsing which reduces risk, though no explicit filtering of the data content is performed.
Audit Metadata