xiaohongshu-dailytop
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/fetch_daily_top.pyusing standard libraries to interact with the service API. The execution is scoped to the skill's own scripts. - [DATA_EXFILTRATION]: The skill transmits the user-provided
DOUBAOYA_API_KEYtodoubaoya.comto authenticate requests. This is the documented and intended communication path for the skill's functionality and does not involve unauthorized data access. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external social media data, which acts as a potential surface for indirect injection.
- Ingestion points: The
fetch_daily_top.pyscript retrieves note titles and metrics from the doubaoya.com API into the agent context. - Boundary markers: Absent. The instructions do not specify explicit delimiters for the agent when handling retrieved note titles.
- Capability inventory: The skill is limited to data retrieval and display; it does not possess file-writing, system-modification, or arbitrary shell execution capabilities beyond the initial fetch script.
- Sanitization: Absent. The skill does not explicitly sanitize or filter the titles retrieved from the API.
Audit Metadata