tiktok-research
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from TikTok video descriptions and metadata. \n
- Ingestion points: External data enters the system through
fetch_tiktok.py, which retrieves post content via the Apify TikTok Scraper API. \n - Boundary markers: There are no explicit delimiters or instructions provided to the AI agent to ignore potentially malicious instructions embedded within the video text during analysis or report generation. \n
- Capability inventory: The skill instructions include capabilities for file creation (
report.md), local script execution, and interaction with an external AI analysis service (video-content-analyzer). \n - Sanitization: While
analyze_posts.pyuses regex for keyword extraction, there is no sanitization or escaping of the raw video text before it is passed to the AI for structure and hook analysis. \n- [EXTERNAL_DOWNLOADS]: The skill fetches video metadata and engagement metrics from Apify's cloud-based scraping infrastructure. This is an expected behavior for a research tool leveraging well-known third-party data providers. \n- [COMMAND_EXECUTION]: The defined workflow requires the execution of Python scripts provided within the skill's package. These scripts manage data retrieval and statistical analysis within localized run folders.
Audit Metadata