scraping-tiktok-profile-data

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill references a script at scripts/run_actor.js and provides instructions for the agent to execute it. Since the script is not included in the skill distribution, its actions cannot be verified and depend on an external file.
  • [DYNAMIC_EXECUTION]: The customMapFunction input allows for the execution of arbitrary JavaScript code strings to process data. This presents a surface for dynamic code execution within the external processing environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content retrieved from TikTok accounts, such as bio text and signatures. Ingestion points: Profile metadata retrieved from the Apify actor as described in SKILL.md. Boundary markers: None provided to prevent the agent from interpreting instructions found within scraped content. Capability inventory: The skill instructions include writing to files via command line arguments and making network requests via curl. Sanitization: There is no implementation of filtering or escaping for the ingested external content before it is processed or presented.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 06:50 PM
Security Audit — agent-trust-hub — scraping-tiktok-profile-data