skill-trending-topics
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches real-time trending data from third-party public API providers
60s.viki.moeandv2.xxapi.cn. These endpoints are used to retrieve JSON data for various social media platforms (Weibo, Douyin, Bilibili, etc.). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content retrieved from external APIs to generate content suggestions, which could lead to unintended behavior if the retrieved data contains malicious prompts.
- Ingestion points: Data is ingested via the
web_fetchtool from external URLs provided inSKILL.md(e.g.,https://60s.viki.moe/v2/weibo). - Boundary markers: The instructions lack explicit boundary markers or "ignore embedded instructions" warnings for the content fetched from external APIs.
- Capability inventory: The skill utilizes
web_fetchfor network retrieval and has read access to sensitive local profile files includingidentity.md,style.md,platforms.md, andaudience.md. - Sanitization: There is no evidence of filtering, escaping, or schema validation for the strings returned by the external hot-search APIs before they are interpolated into the final output or used for analysis.
Audit Metadata