finding-fitness-brands-on-tiktok
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from TikTok, such as video descriptions and channel bios, which are untrusted external sources.
- Ingestion points: Data returned from the TikTok Scraper actor (SKILL.md).
- Boundary markers: None identified to separate instructions from processed data.
- Capability inventory: The skill uses subprocess execution (node scripts), file system writing (CSV/JSON output), and network operations (curl/Apify API).
- Sanitization: No specific sanitization or filtering logic is described for the ingested TikTok content.
- [DYNAMIC_EXECUTION]: The
customMapFunctioninput parameter allows the agent to pass a JavaScript function as a string to be executed on the Apify platform. While this is a feature of the underlying tool, providing an interface for raw code injection into a remote execution environment is a dynamic execution surface. - [COMMAND_EXECUTION]: The documentation instructs the agent to execute shell commands using
node scripts/run_actor.jsandcurl. These commands interact with the local file system (saving results) and the network (communicating with Apify's API).
Audit Metadata