tiktok-campaign-audit
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes data from external sources (TikTok Ads Manager and RevenueCat) to drive logic that executes state-changing commands.
- Ingestion points: Untrusted data enters the agent context via the
tiktok_ads_performanceandrc_overviewtool outputs. - Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions within the ingested performance data.
- Capability inventory: The skill includes scripts that call
tiktok_ads_update_campaignandtiktok_ads_update_ad_statusbased on the processed data. - Sanitization: There is no evidence of data validation or sanitization before external content is interpolated into the decision-making logic for campaign modifications.
- [COMMAND_EXECUTION]: The skill utilizes several Model Context Protocol (MCP) tools to interact with advertising platforms. While these are consistent with the skill's primary purpose, they represent the execution of privileged operations in an external environment.
- Tools invoked:
tiktok_ads_credentials_status,tiktok_ads_list_advertisers,tiktok_ads_performance,tiktok_ads_list_ads,rc_overview,tiktok_ads_update_campaign,tiktok_ads_update_ad_status,tiktok_ads_list_campaigns, andtiktok_ads_list_adgroups.
Audit Metadata