tiktok-posts-discover-by-profile-url
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external TikTok profiles, which serves as an ingestion point for untrusted content.
- Ingestion points: The script
scripts/tiktok_task.pyfetches post data from TikTok via the Frevana API (ai-factory.frevana.com). - Boundary markers: Results are returned as raw JSON arrays without boundary delimiters or instructions to the agent to treat the content as potentially untrusted data.
- Capability inventory: The skill script has network access (
urllib.request) and filesystem write access (shutil.copyfile,Path.write_text). - Sanitization: While the script performs robust regular expression validation on input TikTok URLs, it does not sanitize the contents of the posts retrieved from TikTok before passing them to the agent.
Audit Metadata