xiaohongshu-card-notes
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Includes a shared utility script,
download_videos_from_manifest_with_ytdlp.mjs, which facilitates the download of video content using the well-knownyt-dlptool based on a provided manifest. - [COMMAND_EXECUTION]: Executes the
yt-dlputility and internal JavaScript build scripts vianodeandpython3subprocesses as part of its standard media handling and packaging operations. - [CREDENTIALS_UNSAFE]: The skill manages its own API session tokens and configuration within the standard vendor directory (
~/.config/postplus/config.json). This is legitimate session management for the PostPlus platform. - [DATA_EXFILTRATION]: Communicates with the vendor's official API base URL for media generation, status tracking, and session token refreshing. These network operations are consistent with the skill's stated purpose of utilizing hosted capabilities.
Audit Metadata