finding-tiktok-creators-using-trending-sounds
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documentation describes a
customMapFunctioninput parameter that accepts a string representing a JavaScript function. This function is intended to transform output objects on the Apify platform, which constitutes dynamic code execution at runtime. - [COMMAND_EXECUTION]: The skill provides instructions to execute shell commands using
node scripts/run_actor.jsandcurl. These commands interact with external APIs and local scripts to perform data scraping tasks. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from TikTok (usernames, hashtags, post metadata). This creates a surface for indirect prompt injection if the scraped content contains malicious instructions that could influence the agent's behavior during the scoring or summarization phases.
- Ingestion points: TikTok music/sound page URLs processed by the Apify actor.
- Boundary markers: None specified in the instructions.
- Capability inventory: Execution of local node scripts and network requests via curl.
- Sanitization: No explicit sanitization of the scraped data is mentioned before processing.
Audit Metadata