qinghu-tiktok-product-analyst
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external TikTok product comments and descriptions. This ingestion of external data creates a surface where malicious instructions embedded in the comments could potentially influence agent behavior.\n
- Ingestion points: Tools such as tiktok_product_comment and tiktok_product_detail fetch external text data as documented in SKILL.md.\n
- Boundary markers: The instructions lack specific delimiters or boundary markers to isolate external content from the agent's internal instructions.\n
- Capability inventory: The agent uses network-based tools like curl, fetch, and requests to interact with the vendor's API endpoints at iqinghu.com.\n
- Sanitization: No validation, filtering, or sanitization routines are specified for the incoming external text data before analysis.
Audit Metadata