tiktok-scraper
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external content from TikTok, including post descriptions and user comments, which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: Data enters the agent context through the TikTok Scraper API endpoints such as
/api/post/{id}/commentsand/api/post/search. - Boundary markers: The provided instructions do not include specific delimiters or instructions to ignore embedded commands in the fetched data.
- Capability inventory: The skill's functionality is limited to data retrieval and does not include dangerous write or execution capabilities.
- Sanitization: The documentation does not specify sanitization or validation of the retrieved social media content before it is processed by the agent.
Audit Metadata