tiktok-content
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the EachLabs API (
eachsense-agent.core.eachlabs.run) to generate AI content. These operations are core to the skill's primary functionality. - [SAFE]: The skill uses placeholders like
$EACHLABS_API_KEYandYOUR_EACHLABS_API_KEYfor authentication, which adheres to security best practices for handling sensitive credentials. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes user-supplied text descriptions and image URLs (
SKILL.md) as input for AI generation. - Boundary markers: The instructions do not provide explicit delimiters or instructions to ignore potential injection within the user content.
- Capability inventory: The skill is designed to call external APIs using tools like
Bash(curl)andWebFetchto process this data. - Sanitization: There is no explicit sanitization of inputs mentioned in the skill; safety relies on the downstream AI model's own guardrails.
Audit Metadata