The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell wrapper scripts/tiktok_ads.sh to call a Python CLI tool scripts/tiktok_ads.py. This includes launching a temporary local HTTP server on localhost to handle OAuth authorization callbacks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests JSON data from the external TikTok Business API (via decode_response in scripts/tiktok_ads.py). It has the capability to perform further network mutations (POST/PUT/DELETE) and write data to the local file system (credentials and reports). While it includes redaction and path validation, this processing of external data constitutes an indirect prompt injection attack surface.
[DATA_EXFILTRATION]: The skill manages sensitive API credentials and implements proactive safety measures. The redact function in scripts/tiktok_ads.py ensures secrets are not leaked to terminal logs, and the write_json_securely function enforces strict 0600 permissions on the credentials.json file to prevent unauthorized access.
[EXTERNAL_DOWNLOADS]: The skill performs network operations targeting the official TikTok API host business-api.tiktok.com and authorization host ads.tiktok.com. These interactions are restricted to versioned paths under /open_api/v1.3/ with no absolute URL overrides allowed.

tiktok-ads