xiaohongshu-dailytop

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script scripts/fetch_daily_top.py using standard libraries to interact with the service API. The execution is scoped to the skill's own scripts.
  • [DATA_EXFILTRATION]: The skill transmits the user-provided DOUBAOYA_API_KEY to doubaoya.com to authenticate requests. This is the documented and intended communication path for the skill's functionality and does not involve unauthorized data access.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external social media data, which acts as a potential surface for indirect injection.
  • Ingestion points: The fetch_daily_top.py script retrieves note titles and metrics from the doubaoya.com API into the agent context.
  • Boundary markers: Absent. The instructions do not specify explicit delimiters for the agent when handling retrieved note titles.
  • Capability inventory: The skill is limited to data retrieval and display; it does not possess file-writing, system-modification, or arbitrary shell execution capabilities beyond the initial fetch script.
  • Sanitization: Absent. The skill does not explicitly sanitize or filter the titles retrieved from the API.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 11:44 AM
Security Audit — agent-trust-hub — xiaohongshu-dailytop