The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill utilizes the DOUBAOYA_API_KEY environment variable for authentication, which is a standard and secure method for managing API secrets. The documentation and scripts include explicit instructions and logic to prevent the exposure or logging of these credentials.
Evidence: SKILL.md and scripts/fetch_low_fans_top.py correctly handle the DOUBAOYA_API_KEY environment variable.
[EXTERNAL_DOWNLOADS_AND_REMOTE_CODE_EXECUTION]: The skill performs network requests to its primary backend service at doubaoya.com. These requests are restricted to fetching data in JSON format and do not involve the execution of remote scripts or unverified code.
Evidence: The script scripts/fetch_low_fans_top.py uses urllib.request to POST to https://doubaoya.com/api/apis/xiaohongshu/xiaohongshu-low-fans-top/call.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data (Xiaohongshu note titles and statistics) which is displayed to the user. While this represents a potential surface for indirect injection, the risk is minimal as the content is treated as data for tabular display rather than as primary instructions.
Ingestion points: scripts/fetch_low_fans_top.py output containing external social media content.
Boundary markers: Absent; data is printed directly to stdout for the agent to process.
Capability inventory: Network requests (doubaoya.com), local file read (.version).
Sanitization: Absent; content is passed as raw JSON strings.

xiaohongshu-lowtop