The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external video metadata and URLs, which represents a potential injection surface, but it is well-mitigated.
Ingestion points: Video titles, captions, and remote URLs are ingested from user input; account status and restrictions are fetched from https://open.tiktokapis.com/v2 via the creator_info endpoint.
Boundary markers: The skill explicitly requires the request_action_confirmation tool for all posting and draft actions, ensuring the user reviews the final payload before any external network activity occurs.
Capability inventory: The system utilizes a local Python script (scripts/tiktok.py) to perform network requests to the TikTok API, read local video files, and manage temporary JSON configuration files.
Sanitization: The helper script enforces strict validation, including title length checks, duration limits based on actual account capabilities, and interaction setting validation. It also strictly restricts remote video sources to the verified acedata.cloud domain.
[EXTERNAL_DOWNLOADS]: The skill supports fetching video content from remote URLs using the PULL_FROM_URL method.
The script restricts these downloads to the verified acedata.cloud domain, which belongs to the skill's author, and ensures the use of secure HTTPS with no redirects.
[COMMAND_EXECUTION]: The skill uses standard tools like curl, jq, and a bundled Python script to perform its operations.
These commands are used for legitimate API interactions and local file processing required for TikTok integration, utilizing platform-provided environment variables for authentication.

tiktok