tiktok-api
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted data from TikTok (e.g., video comments and profile bios) which could potentially contain malicious instructions. Ingestion points: Data is retrieved from endpoints like /api/post/search and /api/post/{id}/comments as documented in references/endpoints.md. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present. Capability inventory: The agent can make HTTP GET requests to external APIs. Sanitization: The skill does not describe any sanitization processes for the external data.
- [EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's API at tiktok.fetcher.sh. These network operations are necessary for the skill's primary function and are conducted with the vendor's own infrastructure.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses safe placeholders for API keys in documentation and examples, and correctly advises users to manage credentials via environment variables.
Audit Metadata