The Agent Skills Directory

[DYNAMIC_EXECUTION]: The customMapFunction input parameter allows for the execution of arbitrary JavaScript code provided as a string. This creates a dynamic execution sink where untrusted or agent-generated logic can be processed during the data transformation phase.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local script scripts/run_actor.js using Node.js. This script is not defined within the skill file and its behavior depends on external file content.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and return data from external TikTok location pages, which constitutes an attack surface for indirect prompt injection if the scraped content contains malicious instructions intended for the agent.
Ingestion points: TikTok location and place URLs provided in the startUrls parameter (e.g., SKILL.md).
Boundary markers: None. There are no instructions or delimiters specified to prevent the agent from interpreting content within the scraped data as instructions.
Capability inventory: The skill uses shell command execution (node) and network operations (curl).
Sanitization: No sanitization, filtering, or validation of the retrieved TikTok content is described before it is returned for downstream analysis.
[EXTERNAL_DOWNLOADS]: The skill references and interacts with the Apify API (api.apify.com) to run the TikTok scraper actor. This is a well-known service used for the skill's primary data collection purpose.

scraping-tiktok-posts-by-location