scraping-tiktok-user-data
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external TikTok profiles and videos (such as captions, descriptions, and metadata).
- Ingestion points: Untrusted content enters the agent's context through TikTok profile and video URLs specified in the
startUrlsinput. - Capability inventory: The skill utilizes
nodeto run local scripts,curlfor network requests to the Apify API, and supports local file creation (JSON/CSV output). - Boundary markers: The skill does not define specific delimiters or instructions to the agent to disregard potentially malicious text embedded within the scraped TikTok data.
- Sanitization: There is no evidence of sanitization or filtering of the scraped content before it is delivered to the agent or saved to files.
- [COMMAND_EXECUTION]: The skill documentation provides shell commands using
nodeandcurlto interface with the Apify platform and execute a local script (run_actor.js) for data management. - [EXTERNAL_DOWNLOADS]: The skill interacts with external APIs on
api.apify.comto trigger scraping tasks and retrieve datasets. Apify is a well-known automation and scraping service.
Audit Metadata